{"cve":"CVE-2026-23443","nvd":{"published":"2026-04-03T16:16:28.573","modified":"2026-07-24T21:10:00.143","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: processor: Fix previous acpi_processor_errata_piix4() fix\n\nAfter commi f132e089fe89 (\"ACPI: processor: Fix NULL-pointer dereference\nin acpi_processor_errata_piix4()\"), device pointers may be dereferenced\nafter dropping references to the device objects pointed to by them,\nwhich may cause a use-after-free to occur.\n\nMoreover, debug messages about enabling the errata may be printed\nif the errata flags corresponding to them are unset.\n\nAddress all of these issues by moving message printing to the points\nin the code where the errata flags are set.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-476"],"references":["https://git.kernel.org/stable/c/2e369ba9eb7b8a06e9cc35a3e7fe73e59272f8c2","https://git.kernel.org/stable/c/68408e8f9e366ad9850a66ac65cb569f13bf6cd4","https://git.kernel.org/stable/c/8583f62259e1b315d5239371adfb36939cdab741","https://git.kernel.org/stable/c/98473309a36acc271009b85e0bb53a4c0dddf5c2","https://git.kernel.org/stable/c/bf504b229cb8d534eccbaeaa23eba34c05131e25"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:28:59.047572785+00:00"},"epss":{"cve":"CVE-2026-23443","score":0.00124,"percentile":0.02095,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}