The Linux kernel's ACPI pfr_update feature had a stack buffer overflow vulnerability (CVE-2026-89587) in the query_capability() function. This function copied four ACPI buffer objects returned by the firmware _DSM into fixed-size u8[16] arrays using memcpy without checking the length of the buffers. If the firmware returned a buffer length greater than 16 bytes, memcpy would write past the destination array, causing a stack overflow. The vulnerable struct pfru_update_cap_info is stack-allocated in pfru_ioctl(). Kernel Address Sanitizer (KASAN) testing on version 7.2-rc6 confirmed multiple out-of-bounds writes when oversized buffers (64 bytes) were returned by the firmware. The patch adds validation of buffer lengths against the destination field sizes and returns -EINVAL if oversized buffers are detected, preventing the overflow.

This vulnerability allows a stack buffer overflow in the Linux kernel when processing ACPI firmware data, which could lead to memory corruption and potential kernel instability or escalation of privileges if exploited. However, no known exploits in the wild have been reported.

A fix has been implemented that validates buffer lengths before copying to prevent stack buffer overflows. Users should apply the official Linux kernel patch that introduces this validation. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the input, so check the vendor advisory for current remediation guidance.