Linux Kernel CVE-2026-53047

The vulnerability resides in drivers/firmware/efi/capsule-loader.c, specifically the __efi_capsule_setup_info() function, which manages the cap_info->phys dynamic array - a sequence of phys_addr_t values tracking physical memory page addresses for EFI firmware update capsule delivery. The krealloc() call erroneously passes sizeof(phys_addr_t *) (pointer size) rather than sizeof(phys_addr_t) (the actual data element size). On 64-bit architectures both are 8 bytes, so the defect is silent. On 32-bit kernels with PAE (Physical Address Extension), phys_addr_t is a 64-bit u64 while native pointers are 32-bit, causing krealloc() to return a buffer half the required size. Subsequent calls to page_to_phys() store full 64-bit values into this undersized allocation, overrunning the heap region. This is a recurrence of the same sizeof error previously corrected at the initial allocation site in commit fccfa646ef36. The CPE identifier cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* spans all Linux kernel versions from the introduction commit f24c4d478013d82bd1b943df566fff3561d52864 onward across affected stable branches.