Executive brief
The Linux kernel's ACPI Platform Error Interface (APEI) Generic Hardware Error Source (GHES) driver contains a buffer management error when processing ARM processor error records. A miscalculation of remaining buffer size can allow the kernel to read past the bounds of an error data section, potentially causing a kernel crash or information disclosure on systems with ARM processors that report hardware errors.
Technical details
A pointer arithmetic and length accounting bug exists in the ghes_handle_arm_hw_error() function in drivers/acpi/apei/ghes.c. After advancing a pointer past the cper_sec_proc_arm header using (err + 1), the remaining length is decremented by sizeof(err) (typically 4–8 bytes for a pointer) instead of sizeof(*err) (the actual structure size). This causes the length accounting to underestimate remaining bytes, allowing the parser to read past the CPER section boundary when err_info_num is sufficiently large relative to error_data_length. The fix changes the single decrement from sizeof(err) to sizeof(*err) to align pointer arithmetic with length tracking. Patches are available in the Linux kernel stable tree (commits 452eb28e and 5ff385e9).
Affected products
- Linux Linux kernel Multiple versions (patches applied across linux-3.x through linux-7.2.y stable branches)
Timeline
- 2026-09-11: disclosed: CVE-2026-89588 published
- 2026-09-07: patched: Patches committed to stable kernel branches
- 2026-08-06: other: Fix authored by TanZheng