Executive brief
A vulnerability in the Linux kernel's error handling for ARM processors could allow a system crash. If the system's firmware (BIOS) provides malformed or incomplete hardware error reports, the kernel may attempt to read memory outside of the intended boundaries. This results in a kernel 'oops' or crash, leading to a denial of service for the affected system.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's ACPI Platform Error Interface (APEI) and Generic Hardware Error Source (GHES) drivers. The root cause is insufficient validation of the 'section_length' and 'ctx_info->size' fields within ARM Processor Error records provided by the BIOS. When the kernel processes a GHESv2 record that is smaller than expected or incomplete, it fails to verify that the claimed lengths stay within the allocated memory buffer. An attacker with the ability to influence firmware-to-OS error reporting (typically requiring local privileges or specific hardware access) could trigger a kernel NULL pointer dereference or an 'Oops' (crash) in 'log_arm_hw_error'. Patches have been released for multiple stable kernel branches to add appropriate length checks.
Affected products
- Linux Linux Kernel 6.12.63 to 6.12.75, 6.18.2 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-01-08: other: Patch authored
- 2026-05-06: disclosed: CVE published
- 2026-05-11: advisory: NVD enrichment and analysis completed