Medium [CVE-2026-80593] (asus_atk0110) Check package count before accessing element

In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_atk0110) Check package count before accessing element atk_ec_present() walks the management group package returned by the GGRP ACPI method and, for each sub-package, reads its first element: id = &obj->package.elements[0]; if (id->type!= ACPI_TYPE_INTEGER) without checking that the sub-package is non-empty.

ACPICA allocates the element array with exactly package.count entries, so for a sub-package with a zero count this reads past the allocation. The sibling function atk_debugfs_ggrp_open() performs the same access but skips empty packages with a package.count check first.

Add the same check to atk_ec_present() so a malformed firmware package cannot trigger an out-of-bounds read. A flaw was found in the Linux kernel, specifically within the hwmon (hardware monitoring) subsystem's asus_atk0110 driver.

This vulnerability occurs because the `atk_ec_present()` function does not properly check the size of a data package before attempting to read its contents. A local attacker could exploit this by providing a specially crafted firmware package, which could lead to an out-of-bounds read.

This could result in information disclosure or potentially cause system instability. Red Hat severity: Low — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-125.