CVE-2026-80593

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hwmon: (asus_atk0110) Check package count before accessing element<br /> <br /> atk_ec_present() walks the management group package returned by the GGRP<br /> ACPI method and, for each sub-package, reads its first element:<br /> <br /> id = &amp;obj-&gt;package.elements[0];<br /> if (id-&gt;type != ACPI_TYPE_INTEGER)<br /> <br /> without checking that the sub-package is non-empty. ACPICA allocates the<br /> element array with exactly package.count entries, so for a sub-package<br /> with a zero count this reads past the allocation.<br /> <br /> The sibling function atk_debugfs_ggrp_open() performs the same access but<br /> skips empty packages with a package.count check first. Add the same<br /> check to atk_ec_present() so a malformed firmware package cannot trigger<br /> an out-of-bounds read.