CVE-2026-43266

{"id": "CVE-2026-43266", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43266", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:32:39.290621Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2f74f09bce4f8d0236f20174a6daae63e10fe733", "lessThan": "c80113dcfc807308f5ab33847fae77e07531aeb8", "versionType": "git"}, {"status": "affected", "version": "2f74f09bce4f8d0236f20174a6daae63e10fe733", "lessThan": "ca2aad8771aa9091bc9e42e7d546bd40b72ddcd4", "versionType": "git"}, {"status": "affected", "version": "2f74f09bce4f8d0236f20174a6daae63e10fe733", "lessThan": "a68d22902a6916e10ee235fee609239004e129d0", "versionType": "git"}, {"status": "affected", "version": "2f74f09bce4f8d0236f20174a6daae63e10fe733", "lessThan": "64eb63f573f497553e1a0c388bbcdd639e0f0704", "versionType": "git"}, {"status": "affected", "version": "2f74f09bce4f8d0236f20174a6daae63e10fe733", "lessThan": "be10c1bdf64a39832998f54900aa309b3917abcf", "versionType": "git"}, {"status": "affected", "version": "2f74f09bce4f8d0236f20174a6daae63e10fe733", "lessThan": "25b290624b0e3d2f0f90238709ee0b6009b9fde8", "versionType": "git"}, {"status": "affected", "version": "2f74f09bce4f8d0236f20174a6daae63e10fe733", "lessThan": "45766863baf899059e75595dd3cb1116467f2095", "versionType": "git"}, {"status": "affected", "version": "2f74f09bce4f8d0236f20174a6daae63e10fe733", "lessThan": "eae21beecb95a3b69ee5c38a659f774e171d730e", "versionType": "git"}], "programFiles": ["drivers/firmware/efi/cper-arm.c", "drivers/firmware/efi/cper.c", "include/linux/cper.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.13"}, {"status": "unaffected", "version": "0", "lessThan": "4.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.252", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.202", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.165", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.128", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.75", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/firmware/efi/cper-arm.c", "drivers/firmware/efi/cper.c", "include/linux/cper.h"], "defaultStatus": "affected"}]}], "published": "2026-05-06T12:16:47.647", "references": [{"url": "https://git.kernel.org/stable/c/25b290624b0e3d2f0f90238709ee0b6009b9fde8", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/45766863baf899059e75595dd3cb1116467f2095", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/64eb63f573f497553e1a0c388bbcdd639e0f0704", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a68d22902a6916e10ee235fee609239004e129d0", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/be10c1bdf64a39832998f54900aa309b3917abcf", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c80113dcfc807308f5ab33847fae77e07531aeb8", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ca2aad8771aa9091bc9e42e7d546bd40b72ddcd4", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/eae21beecb95a3b69ee5c38a659f774e171d730e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEFI/CPER: don't go past the ARM processor CPER record buffer\n\nThere's a logic inside GHES/CPER to detect if the section_length\nis too small, but it doesn't detect if it is too big.\n\nCurrently, if the firmware receives an ARM processor CPER record\nstating that a section length is big, kernel will blindly trust\nsection_length, producing a very long dump. For instance, a 67\nbytes record with ERR_INFO_NUM set 46198 and section length\nset to 854918320 would dump a lot of data going a way past the\nfirmware memory-mapped area.\n\nFix it by adding a logic to prevent it to go past the buffer\nif ERR_INFO_NUM is too big, making it report instead:\n\n\t[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1\n\t[Hardware Error]: event severity: recoverable\n\t[Hardware Error]: Error 0, type: recoverable\n\t[Hardware Error]: section_type: ARM processor error\n\t[Hardware Error]: MIDR: 0xff304b2f8476870a\n\t[Hardware Error]: section length: 854918320, CPER size: 67\n\t[Hardware Error]: section length is too big\n\t[Hardware Error]: firmware-generated error record is incorrect\n\t[Hardware Error]: ERR_INFO_NUM is 46198\n\n[ rjw: Subject and changelog tweaks ]"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nEFI/CPER: no exceder el b\u00fafer de registro CPER del procesador ARM\n\nHay una l\u00f3gica dentro de GHES/CPER para detectar si la section_length es demasiado peque\u00f1a, pero no detecta si es demasiado grande.\n\nActualmente, si el firmware recibe un registro CPER del procesador ARM indicando que una longitud de secci\u00f3n es grande, el kernel confiar\u00e1 ciegamente en section_length, produciendo un volcado muy largo. Por ejemplo, un registro de 67 bytes con ERR_INFO_NUM establecido en 46198 y la longitud de secci\u00f3n establecida en 854918320 volcar\u00eda una gran cantidad de datos yendo mucho m\u00e1s all\u00e1 del \u00e1rea mapeada en memoria del firmware.\n\nSolucionarlo a\u00f1adiendo una l\u00f3gica para evitar que exceda el b\u00fafer si ERR_INFO_NUM es demasiado grande, haciendo que informe en su lugar:\n\n\t[Error de hardware]: Error de hardware de la fuente de error de hardware gen\u00e9rica APEI: 1\n\t[Error de hardware]: gravedad del evento: recuperable\n\t[Error de hardware]: Error 0, tipo: recuperable\n\t[Error de hardware]: section_type: error del procesador ARM\n\t[Error de hardware]: MIDR: 0x ff304b2f8476870a\n\t[Error de hardware]: longitud de secci\u00f3n: 854918320, tama\u00f1o CPER: 67\n\t[Error de hardware]: la longitud de secci\u00f3n es demasiado grande\n\t[Error de hardware]: el registro de error generado por el firmware es incorrecto\n\t[Error de hardware]: ERR_INFO_NUM es 46198\n\n[ rjw: Ajustes de asunto y registro de cambios ]"}], "lastModified": "2026-11-11T23:10:00.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "31A910C0-02A8-44D3-BAFE-9E8657D95FED", "versionEndExcluding": "5.10.252", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4002FC2B-1456-4666-B240-0EBF590C4671", "versionEndExcluding": "5.15.202", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "797C7F46-D0BE-4FB8-A502-C5EF8E6B6654", "versionEndExcluding": "6.1.165", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2", "versionEndExcluding": "6.6.128", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2", "versionEndExcluding": "6.12.75", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}