Executive brief
A vulnerability in the Linux kernel's handling of hardware error records could allow a system to crash or disclose sensitive information. When processing malformed firmware error data, the system may attempt to dump large portions of system memory to logs. This can lead to a denial-of-service through a system crash (OOPS) or the exposure of sensitive data in system logs.
Technical details
An integer underflow vulnerability exists in the cper_print_fw_err() function within drivers/firmware/efi/cper.c of the Linux kernel. The issue occurs because the code fails to validate if the error record length is sufficient to accommodate the calculated offset. When processing 'bad' firmware data where the offset exceeds the record length, the subtraction (length -= offset) underflows. This causes the kernel to attempt a hex dump of a massive memory region, which can result in local data disclosure via logs, significant performance degradation, or a kernel OOPS if unmapped memory is accessed. The fix introduces a bounds check to ensure the offset does not exceed the length before proceeding with the dump.
Affected products
- Linux Linux Kernel 5.7 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-01-08: other: Patch authored
- 2026-05-06: disclosed: CVE published
- 2026-05-13: advisory: NVD analysis completed
References
- https://git.kernel.org/stable/c/02de64ab54b4bb0f1b21bb324aeff3b08612be33
- https://git.kernel.org/stable/c/0e09b522f2622841389c3b2f9ac4969e35c0809d
- https://git.kernel.org/stable/c/54e131db4cdffd946db890ff33ff2647053fd4f6
- https://git.kernel.org/stable/c/55cc6fe5716f678f06bcb95140882dfa684464ec
- https://git.kernel.org/stable/c/5a9b1dda8481b82851a655c3bcc5b44879b95334
- https://git.kernel.org/stable/c/64ae5aaa7ac93c83da456039e8ec747bfa8a7cff
- https://git.kernel.org/stable/c/7780c0bad2a3a70a8c0113a33c02f4151d901eb3