Executive brief
A vulnerability in the Linux kernel's handling of EFI memory could cause systems to crash during startup. This issue occurs when the kernel fails to properly reserve a specific memory table, potentially allowing it to be overwritten. This primarily affects high-memory virtual machines, such as Intel TDX instances, leading to a complete system failure (kernel panic).
Technical details
A flaw was found in the reserve_unaccepted() function in drivers/firmware/efi/efi.c. The function incorrectly calculates the size of the memblock reservation for the unaccepted memory table by failing to account for cases where the table's starting physical address (efi.unaccepted) is not page-aligned. If the table starts at an offset within a page and its end crosses into a subsequent page not covered by the aligned size, the end of the table remains unreserved. This can result in the table being overwritten, triggering a kernel panic in accept_memory(). The issue is particularly prevalent in Intel TDX VMs with memory configurations exceeding 64GB. Patches have been released across multiple stable kernel branches to correctly calculate the end address before alignment.
Affected products
- Linux Linux Kernel All versions including and prior to 6.x stable branches (fixed in 2026)
Timeline
- 2026-02-17: patched: Initial fix committed to mainline kernel
- 2026-05-27: disclosed: CVE-2026-45851 published
References
- https://git.kernel.org/stable/c/0862438c90487e79822d5647f854977d50381505
- https://git.kernel.org/stable/c/9b18bf59977f5c5bc3b11b210520f62500a7adf3
- https://git.kernel.org/stable/c/b7bc182ec1846be437351e44164089d988f9d0dd
- https://git.kernel.org/stable/c/ba6b6f1502fa55621d1db23f253d54322bdbe4e0
- https://git.kernel.org/stable/c/e649b5916725c68f44ebf45fb396df563c5dbaf2