Linux kernel APEI GHES: wrong sizeof lets ARM error-record parsing read past the CPER section

Impact

ghes_handle_arm_hw_error() advanced past the cper_sec_proc_arm header with (err + 1) but reduced the remaining length by sizeof(err) - the pointer size - instead of sizeof(*err), the structure size. The remaining byte count is therefore overestimated, and when err_info_num is large relative to error_data_length the parser walks cper_arm_err_info records past the end of the CPER section. This code runs on ARM64 hosts when firmware reports a hardware error through APEI, so it fires during the exact event an operator depends on for accurate diagnosis - and on ARM-based GPU systems a hardware-error report from a marginal DIMM or device can push the kernel into reading unrelated memory as error records.

Who can reach it

Not tenant-reachable. The malformed input comes from platform firmware or a BMC generating the CPER records, so it requires firmware that reports an inconsistent err_info_num, or control over the error-record path. ARM64 hosts only.

What to do

Update to a stable kernel that uses sizeof(*err) so the length accounting matches the pointer advance, then reboot the affected ARM64 nodes. x86 hosts do not take this path. Where a node is already logging APEI ARM processor errors, treat the reboot as urgent rather than routine, since the faulty parse runs on every such report. The record lists four stable commits and no fixed version.

References

Related entries

• Linux kernel RDMA/counter: failed QP bind leaks the port counter count and wedges counter modeCVE-2026-97477 · Linux kernel RDMA/counter (num_counters leak in alloc_and_bind() error path)Unscored
• Linux kernel hfi1: PIO credit-return mmap installs a bad pfn and oopses the nodeCVE-2026-98216 · Linux kernel IB/hfi1 (PIO_CRED credit-return mmap)Unscored
• Linux kernel RDMA/ucma: race between concurrent multicast join and leave frees in-use stateCVE-2026-98253 · Linux kernel RDMA/ucma (multicast join/leave serialization)Unscored
• Linux kernel RDS/IB: protocol version mismatch deadlocks the RDS connection workqueuesCVE-2026-98257 · Linux kernel RDS over InfiniBand (rds_ib_cm_connect_complete)Unscored
• Linux kernel RDMA/siw: out-of-bounds write from fragmented DDP/RDMAP header copiesCVE-2026-98323 · Linux kernel RDMA/siw (software iWARP DDP/RDMAP header parsing)Unscored
• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored