CVE-2026-100072: ACPI: platform: Use acpi_bus_get_primary_device()
High 7.8 EPSS 0.2% Linux kernel
In the Linux kernel, the following vulnerability has been resolved: ACPI: platform: Use acpi_bus_get_primary_device() The acpi_get_first_physical_node() usage in acpi_platform_fill_resource() and acpi_create_platform_device() is generally unsafe because in theory the device returned by it may be freed at any time [1]. It is also inefficient because acpi_get_first_physical_node() is called multiple times for the same argument which can be avoided. Address these issues by using acpi_bus_get_primary_device() instead of acpi_get_first_physical_node() and adjusting the code to call it just once at the beginning of and acpi_create_platform_device() and drop the device reference acquired by it upon the return from that function.
- CVE-2026-100072CVE identifier
- 7.8CVSS 3.1 base score (high)
- 0.2%EPSS: chance of exploitation in the next 30 days (higher than 5% of CVEs)
- 2026-09-25published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run Linux kernel and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Reboot into the new kernel (uname -r to confirm); live patching (kpatch, Ubuntu Livepatch, SUSE kGraft/klp) can defer the reboot for some CVEs
Affected and fixed versions
Affected:
- Linux Linux 3b95bd160547f56a68aeb972c33ae9511e7a8380 to before a75e5de593ef158feb17989bff7730c5a3d82503
- Linux Linux 3b95bd160547f56a68aeb972c33ae9511e7a8380 to before 527a497fb2ef77a95170eefe2007e2c4c957bd2c
- Linux Linux 3b95bd160547f56a68aeb972c33ae9511e7a8380 to before c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71
- Linux Linux 3b95bd160547f56a68aeb972c33ae9511e7a8380 to before a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd
- Linux Linux 4.6
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade linux-image-amd64Ubuntu
sudo apt update
sudo apt install --only-upgrade linux-image-generic (or the installed flavour: linux-image-aws, -azure, -gcp, -virtual)RHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh kernelFedora
sudo dnf upgrade --refresh kernelSUSE / openSUSE
sudo zypper refresh
sudo zypper update kernel-defaultAmazon Linux
sudo dnf upgrade --releasever=latest kernel kernel6.12Arch Linux
sudo pacman -SyuAlpine
apk update && apk upgrade linux-lts linux-virtFreeBSD
not LinuxGeneral update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | linux | not fixed yet | |
| Debian 13 | linux | fixed | 6.12.115-2 |
| Debian testing | linux | fixed | 7.2.6-1 |
| Ubuntu 18.04 (ESM) | linux | not planned | |
| Ubuntu 20.04 (ESM) | linux | not planned | |
| Ubuntu 22.04 | linux | not fixed yet | |
| Ubuntu 24.04 | linux | not fixed yet | |
| Ubuntu 26.04 | linux | fix pending | |
| Ubuntu 26.10 | linux | not affected | |
| Ubuntu 18.04 (ESM) | linux-hwe | not planned | |
| Ubuntu 18.04 (ESM) | linux-hwe-5.4 | not planned | |
| Ubuntu 20.04 (ESM) | linux-hwe-5.8 | not planned | |
| Ubuntu 20.04 (ESM) | linux-hwe-5.11 | not planned | |
| Ubuntu 20.04 (ESM) | linux-hwe-5.13 | not planned | |
| Ubuntu 20.04 (ESM) | linux-hwe-5.15 | not planned | |
| Ubuntu 22.04 | linux-hwe-5.19 | not planned | |
| Ubuntu 22.04 | linux-hwe-6.2 | not planned | |
| Ubuntu 22.04 | linux-hwe-6.5 | not planned | |
| Ubuntu 22.04 | linux-hwe-6.8 | not fixed yet | |
| Ubuntu 24.04 | linux-hwe-6.11 | not planned | |
| Ubuntu 24.04 | linux-hwe-6.14 | not planned | |
| Ubuntu 24.04 | linux-hwe-6.17 | not fixed yet | |
| Ubuntu 24.04 | linux-hwe-7.0 | fix pending | |
| Ubuntu 18.04 (ESM) | linux-hwe-edge | not planned | |
| Ubuntu 18.04 (ESM) | linux-kvm | not planned | |
| Ubuntu 20.04 (ESM) | linux-kvm | not planned | |
| Ubuntu 22.04 | linux-kvm | not fixed yet | |
| Ubuntu 22.04 | linux-allwinner-5.19 | not planned | |
| Ubuntu 18.04 (ESM) | linux-aws | not planned | |
| Ubuntu 20.04 (ESM) | linux-aws | not planned | |
| Ubuntu 22.04 | linux-aws | not fixed yet | |
| Ubuntu 24.04 | linux-aws | not fixed yet | |
| Ubuntu 26.04 | linux-aws | fix pending | |
| Ubuntu 26.10 | linux-aws | not affected | |
| Ubuntu 18.04 (ESM) | linux-aws-5.0 | not planned | |
| Ubuntu 18.04 (ESM) | linux-aws-5.3 | not planned | |
| Ubuntu 18.04 (ESM) | linux-aws-5.4 | not planned | |
| Ubuntu 20.04 (ESM) | linux-aws-5.8 | not planned | |
| Ubuntu 20.04 (ESM) | linux-aws-5.11 | not planned | |
| Ubuntu 20.04 (ESM) | linux-aws-5.13 | not planned | |
| Ubuntu 20.04 (ESM) | linux-aws-5.15 | not planned | |
| Ubuntu 22.04 | linux-aws-5.19 | not planned | |
| Ubuntu 22.04 | linux-aws-6.2 | not planned | |
| Ubuntu 22.04 | linux-aws-6.5 | not planned | |
| Ubuntu 22.04 | linux-aws-6.8 | not fixed yet | |
| Ubuntu 24.04 | linux-aws-6.14 | not planned | |
| Ubuntu 24.04 | linux-aws-6.17 | not planned | |
| Ubuntu 24.04 | linux-aws-7.0 | fix pending | |
| Ubuntu 20.04 (ESM) | linux-azure | not planned | |
| Ubuntu 18.04 (ESM) | linux-azure | not planned | |
| Ubuntu 22.04 | linux-azure | not fixed yet | |
| Ubuntu 24.04 | linux-azure | not fixed yet | |
| Ubuntu 26.04 | linux-azure | fix pending | |
| Ubuntu 26.10 | linux-azure | not affected | |
| Ubuntu 18.04 (ESM) | linux-azure-4.15 | not planned | |
| Ubuntu 18.04 (ESM) | linux-azure-5.3 | not planned | |
| Ubuntu 18.04 (ESM) | linux-azure-5.4 | not planned | |
| Ubuntu 20.04 (ESM) | linux-azure-5.8 | not planned | |
| Ubuntu 20.04 (ESM) | linux-azure-5.11 | not planned | |
| Ubuntu 20.04 (ESM) | linux-azure-5.13 | not planned | |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
Sources
- https://git.kernel.org/stable/c/a75e5de593ef158feb17989bff7730c5a3d82503
- https://git.kernel.org/stable/c/527a497fb2ef77a95170eefe2007e2c4c957bd2c
- https://git.kernel.org/stable/c/c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71
- https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd
- CVE-2026-100072 on CVE.org
- CVE-2026-100072 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.