Skip to main content

Linux Kernel CVE-2026-43277

| EUVDEUVD-2026-27675 MEDIUM
2026-05-06 Linux GHSA-jphw-vq37-q7ww
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.1 MEDIUM

Firmware manipulation to supply a malformed CPER record requires administrator or hypervisor-level access (PR:H) and depends on specific misconfiguration plus a triggered hardware error event (AC:H).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:43 vuln.today
CVSS changed
May 08, 2026 - 19:37 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

APEI/GHES: ensure that won't go past CPER allocated record

The logic at ghes_new() prevents allocating too large records, by checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB). Yet, the allocation is done with the actual number of pages from the CPER bios table location, which can be smaller.

Yet, a bad firmware could send data with a different size, which might be bigger than the allocated memory, causing an OOPS:

Unable to handle kernel paging request at virtual address fff00000f9b40000 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000 [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000 Internal error: Oops: 0000000096000007 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 Workqueue: kacpi_notify acpi_os_execute_deferred pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : hex_dump_to_buffer+0x30c/0x4a0 lr : hex_dump_to_buffer+0x328/0x4a0 sp : ffff800080e13880 x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083 x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004 x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083 x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010 x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020 x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008 x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020 x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000 x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008 Call trace: hex_dump_to_buffer+0x30c/0x4a0 (P) print_hex_dump+0xac/0x170 cper_estatus_print_section+0x90c/0x968 cper_estatus_print+0xf0/0x158 __ghes_print_estatus+0xa0/0x148 ghes_proc+0x1bc/0x220 ghes_notify_hed+0x5c/0xb8 notifier_call_chain+0x78/0x148 blocking_notifier_call_chain+0x4c/0x80 acpi_hed_notify+0x28/0x40 acpi_ev_notify_dispatch+0x50/0x80 acpi_os_execute_deferred+0x24/0x48 process_one_work+0x15c/0x3b0 worker_thread+0x2d0/0x400 kthread+0x148/0x228 ret_from_fork+0x10/0x20 Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44) ---[ end trace 0000000000000000 ]---

Prevent that by taking the actual allocated are into account when checking for CPER length.

[ rjw: Subject tweaks ]

AnalysisAI

Out-of-bounds read in the Linux kernel's APEI/GHES subsystem crashes affected systems when processing malformed or oversized CPER (Common Platform Error Record) data supplied by non-conformant firmware. The ghes_new() function enforces a maximum size check against GHES_ESTATUS_MAX_SIZE (64KB), but the underlying buffer is allocated using the actual page count from the BIOS CPER table location, which may be smaller; when firmware supplies error data exceeding the allocated buffer, subsequent CPER printing via cper_estatus_print_section() triggers a kernel OOPS (level-3 page fault) and system crash. No active exploitation is confirmed: EPSS is 0.02% at the 7th percentile, and this vulnerability is absent from the CISA KEV catalog.

Technical ContextAI

The affected subsystem is APEI/GHES (ACPI Platform Error Interface / Generic Hardware Error Source) in the Linux kernel, responsible for receiving and processing hardware error notifications from firmware in CPER (Common Platform Error Record) format via ACPI-defined memory regions. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the Linux kernel broadly. Although NVD left the CWE field unassigned, the root cause maps to CWE-125 (Out-of-bounds Read) or CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer): the length used during CPER printing is sourced from the untrusted firmware-supplied record header rather than from the actual allocated kernel buffer size. The crash trace confirms the fault occurs in hex_dump_to_buffer(), called transitively through ghes_proc() → cper_estatus_print() → cper_estatus_print_section() → print_hex_dump(), and was reproduced on ARM64 under QEMU with a crafted BIOS ACPI table. The fix adds an explicit bounds check capping CPER traversal at the actual allocated buffer extent.

RemediationAI

Vendor-released patches are available for all active stable branches. Upgrade to kernel version 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, or 7.0 as appropriate for the deployed branch. Upstream fix commits are published at https://git.kernel.org/stable/c/ with the following hashes: 92ba79074c58e65a6e32713758c5a9aecd33c2ea, 616c120dcdf1ce96edcd818e38bce49667f80689, f3740a1562445f36f08afab8af59e37117b3acdc, e0ec99115e135dbb58e11a0df007c7d4771d4a17, b6be51a12441136fdf8c49b2525689fbea1856e1, 6f5d41984ad896736c23e2fff7c80e15c1319132, 98bd9b28d4d11e6739ad86524b4be4ada9025e60, and fa2408a24f8f0db14d9cfc613ef162dc267d7ab4. Ubuntu users should apply USN-8492-1 (https://ubuntu.com/security/notices/USN-8492-1). Where immediate patching is not feasible, disabling APEI/GHES via UEFI/BIOS firmware settings or the kernel boot parameter acpi_noberr prevents the vulnerable code path entirely, but this trade-off is significant: it silences all hardware error reporting, which may mask real hardware failures and complicate diagnostics in production environments. In virtualized deployments, ensuring that guest ACPI tables are supplied only by trusted and validated hypervisor configurations reduces the realistic attack surface.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43277 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy