Executive brief
A vulnerability was identified in the Linux kernel's EFI capsule loader, a component used for updating system firmware. On certain 32-bit systems, the software incorrectly calculates the amount of memory needed when processing firmware updates, which could allow an attacker with high privileges to crash the system or potentially execute unauthorized code. This issue primarily affects systems using Physical Address Extension (PAE) where memory addresses are larger than standard pointers.
Technical details
A heap buffer overflow exists in drivers/firmware/efi/capsule-loader.c within the __efi_capsule_setup_info() function. The root cause is an incorrect use of sizeof(phys_addr_t *) instead of sizeof(phys_addr_t) during a krealloc() call. On 32-bit systems with PAE (Physical Address Extension), phys_addr_t is 64 bits while pointers are 32 bits, resulting in an allocation of only half the required memory. An attacker with sufficient privileges to trigger EFI capsule loading could exploit this undersized allocation to cause a heap buffer overflow when physical addresses are subsequently stored. The issue has been patched across multiple stable kernel branches.
Affected products
- Linux Linux Kernel f24c4d478013 to 48a428215782321b56956974f23593e40ce84b7a
Timeline
- 2026-04-10: disclosed: Initial patch authored by Thomas Huth
- 2026-06-01: patched: Patch committed to stable branches by Greg Kroah-Hartman
- 2026-06-24: advisory: CVE-2026-53047 published in NVD
References
- https://git.kernel.org/stable/c/22022cd8851703a58f67615a17bc7e9e8682785b
- https://git.kernel.org/stable/c/48a428215782321b56956974f23593e40ce84b7a
- https://git.kernel.org/stable/c/5e185330d902b12fe8e6eb4b8514b5d736d8d66d
- https://git.kernel.org/stable/c/608e1f7bc9d171ab26c1fba288c97fc76363c27d
- https://git.kernel.org/stable/c/67adde6bfdfd563a54b045d59aeb9a2d90c80697
- https://git.kernel.org/stable/c/8be69e9245f805566bac68ffc8574b64735fd996
- https://git.kernel.org/stable/c/ab3f7098a3a27175b91cfc947950f5c26855801b