CVE-2026-31426

In the Linux kernel, the following vulnerability has been resolved:

ACPI: EC: clean up handlers on probe failure in acpiecsetup()

When ecinstallhandlers() returns -EPROBEDEFER on reduced-hardware platforms, it has already started the EC and installed the address space handler with the struct acpiec pointer as handler context. However, acpiecsetup() propagates the error without any cleanup.

The caller acpiecadd() then frees the struct acpi_ec for non-boot instances, leaving a dangling handler context in ACPICA.

Any subsequent AML evaluation that accesses an EC OpRegion field dispatches into acpiecspace_handler() with the freed pointer, causing a use-after-free:

BUG: KASAN: slab-use-after-free in mutexlock (kernel/locking/mutex.c:289) Write of size 8 at addr ffff88800721de38 by task init/1 Call Trace: <TASK> mutexlock (kernel/locking/mutex.c:289) acpiecspacehandler (drivers/acpi/ec.c:1362) acpievaddressspacedispatch (drivers/acpi/acpica/evregion.c:293) acpiexaccessregion (drivers/acpi/acpica/exfldio.c:246) acpiexfielddatumio (drivers/acpi/acpica/exfldio.c:509) acpiexextractfromfield (drivers/acpi/acpica/exfldio.c:700) acpiexreaddatafromfield (drivers/acpi/acpica/exfield.c:327) acpiexresolvenodetovalue (drivers/acpi/acpica/exresolv.c:392) </TASK>

Allocated by task 1: acpiecalloc (drivers/acpi/ec.c:1424) acpiecadd (drivers/acpi/ec.c:1692)

Freed by task 1: kfree (mm/slub.c:6876) acpiecadd (drivers/acpi/ec.c:1751)

The bug triggers on reduced-hardware EC platforms (ec->gpe < 0) when the GPIO IRQ provider defers probing. Once the stale handler exists, any unprivileged sysfs read that causes AML to touch an EC OpRegion (battery, thermal, backlight) exercises the dangling pointer.

Fix this by calling ecremovehandlers() in the error path of acpiecsetup() before clearing firstec. ecremovehandlers() checks each ECFLAGS_* bit before acting, so it is safe to call regardless of how far ecinstallhandlers() progressed:

-ENODEV (handler not installed): only calls acpiecstop() -EPROBE_DEFER (handler installed): removes handler, stops EC