EUVD-2026-76500
GHSA-rcxp-8r6g-r5jm
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires firmware or hypervisor control to inject crafted CPER records (PR:H, AC:H); primary impact is kernel panic (A:H) with limited OOB read exposure (C:L); no integrity impact substantiated.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ACPI: APEI: GHES: fix ARM section length accounting after header
In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm header with (err + 1), the remaining length was reduced by sizeof(err) (pointer size) instead of sizeof(*err) (structure size).
That overestimates the bytes left for cper_arm_err_info records and can let the parser read past the CPER section when err_info_num is large enough relative to error_data_length.
Use sizeof(*err) so the length accounting matches the pointer advance and the earlier sizeof(*err) size check.
AnalysisAI
Out-of-bounds read in Linux kernel ACPI APEI GHES ARM hardware error handler arises from using pointer size instead of structure size when accounting for remaining CPER buffer after skipping the cper_sec_proc_arm header. Affected are stable branches 6.12.x through 6.12.109, 6.18.x through 6.18.50, 7.x through 7.2.4, and pre-7.3-rc1, on ARM systems with ACPI APEI support. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of: (1) an ARM architecture system - the ghes_handle_arm_hw_error() code path is ARM-specific and x86/other systems are unaffected; (2) ACPI APEI GHES support compiled and enabled in the kernel, and the platform firmware must expose at least one Generic Hardware Error Source via ACPI tables (non-default on many commodity ARM deployments); (3) the ability to control or inject crafted CPER ARM processor error records, which in practice requires physical firmware access, a compromised BIOS/UEFI, or a malicious hypervisor delivering fabricated ACPI hardware error notifications to a guest OS; (4) the crafted record must set err_info_num large enough relative to error_data_length to exceed the miscalculated boundary. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS vector AV:L/AC:L/PR:N/UI:N/C:H/I:H/A:H deserves scrutiny: triggering this path requires a platform to present crafted CPER ARM processor error records via ACPI firmware tables, which is not a standard unprivileged local operation - it implies either physical/firmware access or control over the hypervisor ACPI layer in a cloud environment, making PR:N and AC:L both overly generous. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux 6.12.109, 6.18.50, 7.2.4, or apply the 7.3-rc1 patch as appropriate for the running branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and catalog all ARM-based systems running Linux kernel versions 6.12.x through 6.12.109, 6.18.x through 6.18.50, or 7.x through 7.2.4 with ACPI APEI enabled (verify via /sys/firmware/acpi); prioritize datacenter and production ARM infrastructure in your assessment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today