CVE-2026-43266

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

EFI/CPER: don't go past the ARM processor CPER record buffer

There's a logic inside GHES/CPER to detect if the section_length

is too small, but it doesn't detect if it is too big.

Currently, if the firmware receives an ARM processor CPER record

stating that a section length is big, kernel will blindly trust

section_length, producing a very long dump. For instance, a 67

bytes record with ERR_INFO_NUM set 46198 and section length

set to 854918320 would dump a lot of data going a way past the

firmware memory-mapped area.

Fix it by adding a logic to prevent it to go past the buffer

if ERR_INFO_NUM is too big, making it report instead:

[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1

[Hardware Error]: event severity: recoverable

[Hardware Error]: Error 0, type: recoverable

[Hardware Error]: section_type: ARM processor error

[Hardware Error]: MIDR: 0xff304b2f8476870a

[Hardware Error

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References