Linux kernel EFI/CPER: an oversized ARM processor error record is trusted and read past the firmware buffer

Impact

The CPER code checks that an ARM processor error section is not too small but never that it is too big. A record claiming a section length of hundreds of megabytes with a large ERR_INFO_NUM is trusted as-is, so the kernel reads and prints far past the end of the firmware memory-mapped area - the example in the fix is a 67-byte record claiming 854918320 bytes. That means kernel log disclosure of whatever lies beyond the buffer and a likely oops when the read leaves mapped memory. This matters on Arm-based accelerator and head nodes, where hardware error records arrive routinely; a crash here takes the node out without a clean drain. Distinct from the firmware-error-record underflow fixed in the same series (CVE-2026-43171): different record type, different check, separate commits.

Who can reach it

Local only, and the malformed input originates from platform firmware rather than a tenant. The resulting memory dump is visible to any local reader of the kernel log. Only applies to Arm hosts processing ARM processor CPER sections.

What to do

Apply the stable kernel update that bounds section_length and ERR_INFO_NUM, then reboot each affected Arm node. No runtime workaround exists; restricting dmesg access limits the disclosure half of the problem but not the oops.

References

Related entries

• Linux kernel CephFS client: punch-hole writes without snapshot context silently corrupt existing snapshotsCVE-2026-43273 · Linux kernel CephFS client (ceph_zero_partial_object missing snapshot context on OSD writes)Medium
• Linux kernel KVM nSVM: userspace can trigger a kernel WARN by changing CPUID after loading CR3CVE-2026-43315 · Linux kernel KVM nSVM (user-triggerable WARN in svm_set_nested_state)Medium
• Linux kernel scheduler: two yielding tasks can overflow vruntime and destabilize the hostCVE-2026-43323 · Linux kernel sched/fair (zero_vruntime not updated at slice end, EEVDF vruntime overflow)Medium
• Linux kernel BPF: verifier lets a program dereference a nullable map-iterator pointer, crashing the kernelCVE-2026-43333 · Linux kernel BPF verifier (check_mem_access allows direct deref of nullable PTR_TO_BUF)Medium
• Linux kernel Intel uncore PMU: die ID lookup bugs trip a warning and skip PMON unitsCVE-2026-43344 · Linux kernel perf/x86/intel/uncore (die ID init and lookup on Intel SPR/EMR)Medium
• Linux kernel KVM arm64: failed vGIC creation leaves redistributor regions uninitialised for teardownCVE-2026-43351 · Linux kernel KVM arm64 vGIC (dist/redist initialisation on create failure)Medium