CVE-2026-43266 EFI/CPER: don't go past the ARM processor CPER record buffer
A logic flaw in the Linux kernel's EFI/CPER handling allows reading memory beyond the intended buffer when processing malformed ARM processor error records.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43266?
CVE-2026-43266 is a medium-severity vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
EFI/CPER: don't go past the ARM processor CPER record buffer
There's a logic inside GHES/CPER to detect if the section_length is too small, but it doesn't detect if it is too big.
Currently, if the firmware receives an ARM processor CPER record stating that a section length is big, kernel will blindly trust section_length, producing a very long dump. For instance, a 67 bytes record with ERR_INFO_NUM set 46198 and section length set to 854918320 would dump a lot of data going a way past the firmware memory-mapped area.
Fix it by adding a logic to prevent it to go past the buffer if ERR_INFO_NUM is too big, making it report instead:
[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1 [Hardware Error]: event severity: recoverable [Hardware Error]: Error 0, type: recoverable [Hardware Error]: section_type: ARM processor error [Hardware Error]: MIDR: 0xff304b2f8476870a [Hardware Error]: section length: 854918320, CPER size: 67 [Hardware Error]: section length is too big [Hardware Error]: firmware-generated error record is incorrect [Hardware Error]: ERR_INFO_NUM is 46198
[ rjw: Subject and changelog tweaks ]
Which versions are affected by CVE-2026-43266?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43266?
Apply the vendor's patch.
Is CVE-2026-43266 being exploited?
There is no known exploitation of CVE-2026-43266 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43266, DEBIAN-CVE-2026-43266, GHSA-r9ph-9m45-xj6w, ROOT-OS-DEBIAN-11-CVE-2026-43266, ROOT-OS-UBUNTU-2204-CVE-2026-43266, ROOT-OS-UBUNTU-2404-CVE-2026-43266 and 1 more.