CVE-2026-43277

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

APEI/GHES: ensure that won't go past CPER allocated record

The logic at ghes_new() prevents allocating too large records, by

checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).

Yet, the allocation is done with the actual number of pages from the

CPER bios table location, which can be smaller.

Yet, a bad firmware could send data with a different size, which might

be bigger than the allocated memory, causing an OOPS:

Unable to handle kernel paging request at virtual address fff00000f9b40000

Mem abort info:

ESR = 0x0000000096000007

EC = 0x25: DABT (current EL), IL = 32 bits

SET = 0, FnV = 0

EA = 0, S1PTW = 0

FSC = 0x07: level 3 translation fault

Data abort info:

ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000

CM = 0, WnR = 0, TnD = 0, TagAccess = 0

GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0

swapper pgtable: 4k pages, 52-bit VAs, pgdp=000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References