Gigabyte UEFI firmware (SMM, OcHeader/OcData pointer control): Unchecked register use lets the attacker control

Impact

Unchecked register use lets the attacker control the OcHeader and OcData pointers handled in SMM, producing arbitrary read and write at ring -2 - the same firmware-persistence outcome as the rest of the batch.

Who can reach it

Local privileged code on the host.

What to do

Gigabyte BIOS update per board plus reboot; delivered in the same firmware image as CVE-2025-7026 through 7028, so treat all four as one change.

References

Related entries

• U-Boot: integer overflow in ZFS metadata parsing gives out-of-bounds access during bootCVE-2025-70290 · Das U-Boot (ZFS filesystem support, on-disk metadata parsing)Unscored
• libtpms (OpenSSL 3.x symmetric cipher IV handling): libtpms 0.10.0/0.10.1 built against OpenSSL 3.x returnedCVE-2026-21444 · libtpms (OpenSSL 3.x symmetric cipher IV handling)Unscored
• Arm Trusted Firmware-A BL1/BL2 boot stages on platforms that load firmware from a Firmware Image Package (FIP)CVE-2026-34878 · Arm Trusted Firmware-A BL1/BL2 boot stages on platforms that load firmware from a Firmware Image Package (FIP) containerUnscored
• Linux kernel IPMI: refcount leak on the supplied-recv error path permanently pins the IPMI userCVE-2026-72040 · Linux kernel IPMI driver (i_ipmi_request supplied-recv error path)Unscored
• Linux kernel i2c-mlxbf (BlueField DPU I2C controller): mlxbf_i2c_init_resource() frees a resource struct and then readsCVE-2026-72140 · Linux kernel i2c-mlxbf (BlueField DPU I2C controller)Unscored
• Linux kernel mlxsw: failed LAG index allocation leaks a LAG reference on Spectrum switchesCVE-2026-72308 · Linux kernel mlxsw (Spectrum switch driver, LAG join error path)Unscored