Medium 5.5Published May 6, 2026

CVE-2026-43266EFI/CPER: don't go past the ARM processor CPER record buffer

Updated under an hour ago (Oct 27, 2026, 6:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't go past the ARM processor CPER record buffer There's a logic inside GHES/CPER to detect if the section_length is too small, but it doesn't detect if it is too big. Currently, if the firmware receives an ARM processor CPER record stating that a section length is big, kernel will blindly trust section_length, producing a very long dump. For instance, a 67 bytes record with ERR_INFO_NUM set 46198 and section length set to 854918320 would dump a lot of data going a way past the firmware memory-mapped area. Fix it by adding a logic to prevent it to go past the buffer if ERR_INFO_NUM is too big, making it report instead: [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1 [Hardware Error]: event severity: recoverable [Hardware Error]: Error 0, type: recoverable [Hardware Error]: section_type: ARM processor error [Hardware Error]: MIDR: 0xff304b2f8476870a [Hardware Error]: section length: 854918320, CPER size: 67 [Hardware Error]: section length is too big [Hardware Error]: firmware-generated error record is incorrect [Hardware Error]: ERR_INFO_NUM is 46198 [ rjw: Subject and changelog tweaks ]

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 2f74f09bce4f8d0236f20174a6daae63e10fe733 before c80113dcfc807308f5ab33847fae77e07531aeb8; from 2f74f09bce4f8d0236f20174a6daae63e10fe733 before ca2aad8771aa9091bc9e42e7d546bd40b72ddcd4; from 2f74f09bce4f8d0236f20174a6daae63e10fe733 before a68d22902a6916e10ee235fee609239004e129d0; from 2f74f09bce4f8d0236f20174a6daae63e10fe733 before 64eb63f573f497553e1a0c388bbcdd639e0f0704; from 2f74f09bce4f8d0236f20174a6daae63e10fe733 before be10c1bdf64a39832998f54900aa309b3917abcf; from 2f74f09bce4f8d0236f20174a6daae63e10fe733 before 25b290624b0e3d2f0f90238709ee0b6009b9fde8; from 2f74f09bce4f8d0236f20174a6daae63e10fe733 before 45766863baf899059e75595dd3cb1116467f2095; from 2f74f09bce4f8d0236f20174a6daae63e10fe733 before eae21beecb95a3b69ee5c38a659f774e171d730e	CNA record
linux linux_kernel linux:linux_kernel	from 4.13 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/c80113dcfc807308f5ab33847fae77e07531aeb8	patch
https://git.kernel.org/stable/c/ca2aad8771aa9091bc9e42e7d546bd40b72ddcd4	patch
https://git.kernel.org/stable/c/a68d22902a6916e10ee235fee609239004e129d0	patch
https://git.kernel.org/stable/c/64eb63f573f497553e1a0c388bbcdd639e0f0704	patch
https://git.kernel.org/stable/c/be10c1bdf64a39832998f54900aa309b3917abcf	patch
https://git.kernel.org/stable/c/25b290624b0e3d2f0f90238709ee0b6009b9fde8	patch
https://git.kernel.org/stable/c/45766863baf899059e75595dd3cb1116467f2095	patch
https://git.kernel.org/stable/c/eae21beecb95a3b69ee5c38a659f774e171d730e	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.