CVE-2026-43201

About vulnerability

In the Linux kernel, the following vulnerability has been resolved: APEI/GHES: ARM processor Error: don’t go past allocated memory If the BIOS generates a very small ARM Processor Error, or an incomplete one, the current logic will fail to deferrence err->section_length and ctx_info->size Add checks to avoid that. With such changes, such GHESv2 records won’t cause OOPSes like this: [ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP [ 1.495449] Modules linked in: [ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT [ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 [ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred [ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=–) [ 1.497199] pc : log_arm_hw_error+0x5c/0x200 [ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220 0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75). 70err_info = (struct cper_arm_err_info *)(err + 1); 71ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); 72ctx_err = (u8 *)ctx_info; 73 74for (n = 0; n < err->context_info_num; n++) { 75sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; 76ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); 77ctx_len += sz; 78} 79 and similar ones while trying to access section_length on an error dump with too small size. [ rjw: Subject tweaks ] A flaw was found in the Linux kernel’s Advanced Processor Error Interface (APEI) / Generic Hardware Error Source (GHES) handling. If the BIOS generates a very small or incomplete ARM Processor Error record, the kernel’s error handling logic can attempt to access memory beyond allocated bounds. This out-of-bounds read can lead to an Operating System Panic (OOPS), effectively causing a denial of service.

Live-patch status from KernelCare for each operating system.