CVE-2026-89588
largeOut-of-Bounds Read in Linux Kernel GHES ARM Processor Error Handler
The Linux kernel's ACPI/APEI GHES subsystem mis-accounts the remaining length of firmware-reported ARM processor error (CPER) records in ghes_handle_arm_hw_error(): after skipping the cper_sec_proc_arm header, the code subtracts sizeof(err) — the size of the pointer (8 bytes on 64-bit) — instead of sizeof(*err), the size of the structure actually skipped. The resulting overestimate lets the parser walk past the end of the error section when err_info_num is large relative to error_data_length, causing an out-of-bounds read in kernel space. Triggering the flaw requires an attacker to control or influence firmware-supplied error records (e.g., via malicious or compromised platform firmware/BMC on an ARM64 system), which limits practical reachability despite the high CVSS 8.4 score; plausible impact includes kernel disclosure of adjacent memory and denial of service via crash. Affected systems are primarily ARM64 platforms using ACPI firmware-first error reporting (servers and some embedded boards) running kernels with the buggy accounting. No public proof of concept exists and no exploitation in the wild has been observed.
What to do: Apply distribution kernel updates that include the upstream one-line fix replacing sizeof(err) with sizeof(*err) in ghes_handle_arm_hw_error(). Because the flaw is reachable only through firmware-supplied CPER error records, maintain platform firmware/BMC integrity and apply vendor firmware patches. Review logs for prior oopses or BUGs originating from GHES/ghes_handle_arm_hw_error() paths to rule out abnormal error-record handling.
| Linux kernel | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm header with (err + 1), the remaining length was reduced by sizeof(err) (pointer size) instead of sizeof(*err) (structure size). That overestimates the bytes left for cper_arm_err_info records and can let the parser read past the CPER section when err_info_num is large enough relative to error_data_length. Use sizeof(*err) so the length accounting matches the pointer advance and the earlier sizeof(*err) size check.
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.