Executive brief
The Linux kernel's coreboot firmware driver did not properly validate memory table boundaries when parsing firmware-supplied configuration data. An attacker with the ability to provide malformed firmware tables could cause the driver to access memory outside the intended resource boundaries, potentially leading to information disclosure, denial of service, or privilege escalation depending on the accessed memory content.
Technical details
The vulnerability exists in the coreboot_table_probe() function in drivers/firmware/google/coreboot_table.c. The driver accepts header and table size values from untrusted firmware without proper validation, then uses these values to determine the memory region to map. A malformed table can cause a 32-bit integer overflow in the size calculation or specify an extent that exceeds the actual resource size. Additionally, resources smaller than the expected fixed header size were mapped and parsed as though they contained a complete header. The fix adds proper bounds checking: rejecting resources shorter than sizeof(struct coreboot_table_header), validating the header signature before trusting its size fields, using overflow-checking arithmetic to calculate the total required size, and rejecting any advertised extent that exceeds the actual resource size before mapping memory.
Affected products
- Linux Linux kernel multiple versions; fixes committed to stable branches from linux-2.6.11.y through linux-7.2.y
Timeline
- 2026-09-17: disclosed: CVE-2026-90341 published
- 2026-09-14: patched: Patch committed to stable branches by Greg Kroah-Hartman
- 2026-08-01: other: Fix developed by Laxman Acharya Padhya