Medium 5.5Published Jun 24, 2026

CVE-2026-53047efi/capsule-loader: fix incorrect sizeof in phys array reallocation

Updated under an hour ago (Oct 28, 2026, 9:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect sizeof in phys array reallocation The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be causing an undersized allocation. The allocation is also inconsistent with the initial array allocation in efi_capsule_open() that allocates one entry with sizeof(phys_addr_t), and the efi_capsule_write() function that stores phys_addr_t values (not pointers) via page_to_phys(). On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but pointers are 32-bit, this allocates half the required space, which might lead to a heap buffer overflow when storing physical addresses. This is similar to the bug fixed in commit fccfa646ef36 ("efi/capsule-loader: fix incorrect allocation size") which fixed the same issue at the initial allocation site.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f24c4d478013d82bd1b943df566fff3561d52864 before 22022cd8851703a58f67615a17bc7e9e8682785b; from f24c4d478013d82bd1b943df566fff3561d52864 before 67adde6bfdfd563a54b045d59aeb9a2d90c80697; from f24c4d478013d82bd1b943df566fff3561d52864 before 608e1f7bc9d171ab26c1fba288c97fc76363c27d; from f24c4d478013d82bd1b943df566fff3561d52864 before 8be69e9245f805566bac68ffc8574b64735fd996; from f24c4d478013d82bd1b943df566fff3561d52864 before 5e185330d902b12fe8e6eb4b8514b5d736d8d66d; from f24c4d478013d82bd1b943df566fff3561d52864 before e0e6b14995fd6fa2c0df8c712d76ab32f0694c31; from f24c4d478013d82bd1b943df566fff3561d52864 before ab3f7098a3a27175b91cfc947950f5c26855801b; from f24c4d478013d82bd1b943df566fff3561d52864 before 48a428215782321b56956974f23593e40ce84b7a; and 2 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 4.14.13 before 4.15; from 4.15.1 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/22022cd8851703a58f67615a17bc7e9e8682785b	patch
https://git.kernel.org/stable/c/67adde6bfdfd563a54b045d59aeb9a2d90c80697	patch
https://git.kernel.org/stable/c/608e1f7bc9d171ab26c1fba288c97fc76363c27d	patch
https://git.kernel.org/stable/c/8be69e9245f805566bac68ffc8574b64735fd996	patch
https://git.kernel.org/stable/c/5e185330d902b12fe8e6eb4b8514b5d736d8d66d	patch
https://git.kernel.org/stable/c/e0e6b14995fd6fa2c0df8c712d76ab32f0694c31	patch
https://git.kernel.org/stable/c/ab3f7098a3a27175b91cfc947950f5c26855801b	patch
https://git.kernel.org/stable/c/48a428215782321b56956974f23593e40ce84b7a	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.