Linux kernel EFI/CPER: oversized offset in a firmware error record makes the kernel dump arbitrary memory

Impact

When the platform hands the kernel a malformed firmware error record through APEI/GHES, cper_print_fw_err() does not check that the record is long enough for the stated offset, so length -= offset underflows and the kernel hex-dumps a huge region of memory into the kernel log. The practical outcomes are kernel memory contents disclosed to anyone who can read dmesg or the system journal, a long stall while the dump runs, and an oops if the walk reaches unmapped memory. GPU nodes are exactly where this path runs hot: these are the machines that report corrected and uncorrected memory and PCIe errors continuously, so the firmware error printing code is live rather than dormant. A node that oopses here has to be rescheduled and rebooted rather than drained gracefully.

Who can reach it

Not remotely reachable. The malformed record comes from platform firmware or BMC-side error injection, not from a tenant; the disclosure is to any local user or agent that can read the kernel log. Exploiting it deliberately needs control over what the firmware reports.

What to do

Take the stable kernel update containing the bounds check and reboot the node; there is no module-level or runtime mitigation, so this is a drain-and-reboot per host. Until then, restrict kernel log access (dmesg_restrict, journal permissions) so a bad dump does not become a disclosure to unprivileged users.

References

Related entries

• Linux kernel arm64: TSV110 CPUs were not getting the Spectre-BHB software mitigationCVE-2026-43261 · Linux kernel arm64 Spectre-BHB mitigation (TSV110 MIDR missing from the affected list)Medium
• Linux kernel KVM: spurious userspace exit when checking nested events can kill the guestCVE-2026-43265 · Linux kernel KVM x86 nested virtualization (vcpu_block() nested-event check returning -EBUSY)Medium
• Linux kernel EFI/CPER: an oversized ARM processor error record is trusted and read past the firmware bufferCVE-2026-43266 · Linux kernel EFI/CPER ARM processor error record parser (section_length / ERR_INFO_NUM not bounded)Medium
• Linux kernel CephFS client: punch-hole writes without snapshot context silently corrupt existing snapshotsCVE-2026-43273 · Linux kernel CephFS client (ceph_zero_partial_object missing snapshot context on OSD writes)Medium
• Linux kernel KVM nSVM: userspace can trigger a kernel WARN by changing CPUID after loading CR3CVE-2026-43315 · Linux kernel KVM nSVM (user-triggerable WARN in svm_set_nested_state)Medium
• Linux kernel scheduler: two yielding tasks can overflow vruntime and destabilize the hostCVE-2026-43323 · Linux kernel sched/fair (zero_vruntime not updated at slice end, EEVDF vruntime overflow)Medium