{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-43277 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-43277 is a medium-severity memory corruption vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-43277 and fix it if it is affected.\n\nWhat it is: CVE-2026-43277 is a medium-severity memory corruption vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-43277 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-43277/ (Markdown: https://insights.sbomify.com/CVE-2026-43277/index.md)","id":"CVE-2026-43277","markdown":"https://insights.sbomify.com/CVE-2026-43277/index.md","name":"CVE-2026-43277","record":{"aliases":["BELL-CVE-2026-43277","DEBIAN-CVE-2026-43277","GHSA-jphw-vq37-q7ww","ROOT-OS-DEBIAN-11-CVE-2026-43277","ROOT-OS-UBUNTU-2204-CVE-2026-43277","ROOT-OS-UBUNTU-2404-CVE-2026-43277","UBUNTU-CVE-2026-43277"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A flaw in the Linux kernel APEI/GHES driver allows a bad firmware to cause a kernel OOPS via memory corruption, leading to denial of service.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nAPEI/GHES: ensure that won't go past CPER allocated record\n\nThe logic at ghes_new() prevents allocating too large records, by\nchecking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).\nYet, the allocation is done with the actual number of pages from the\nCPER bios table location, which can be smaller.\n\nYet, a bad firmware could send data with a different size, which might\nbe bigger than the allocated memory, causing an OOPS:\n\n    Unable to handle kernel paging request at virtual address fff00000f9b40000\n    Mem abort info:\n      ESR = 0x0000000096000007\n      EC = 0x25: DABT (current EL), IL = 32 bits\n      SET = 0, FnV = 0\n      EA = 0, S1PTW = 0\n      FSC = 0x07: level 3 translation fault\n    Data abort info:\n      ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000\n      CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n      GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n    swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000\n    [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000\n    Internal error: Oops: 0000000096000007 [#1]  SMP\n    Modules linked in:\n    CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT\n    Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022\n    Workqueue: kacpi_notify acpi_os_execute_deferred\n    pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n    pc : hex_dump_to_buffer+0x30c/0x4a0\n    lr : hex_dump_to_buffer+0x328/0x4a0\n    sp : ffff800080e13880\n    x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083\n    x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004\n    x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083\n    x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010\n    x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020\n    x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008\n    x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000\n    x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020\n    x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000\n    x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008\n    Call trace:\n     hex_dump_to_buffer+0x30c/0x4a0 (P)\n     print_hex_dump+0xac/0x170\n     cper_estatus_print_section+0x90c/0x968\n     cper_estatus_print+0xf0/0x158\n     __ghes_print_estatus+0xa0/0x148\n     ghes_proc+0x1bc/0x220\n     ghes_notify_hed+0x5c/0xb8\n     notifier_call_chain+0x78/0x148\n     blocking_notifier_call_chain+0x4c/0x80\n     acpi_hed_notify+0x28/0x40\n     acpi_ev_notify_dispatch+0x50/0x80\n     acpi_os_execute_deferred+0x24/0x48\n     process_one_work+0x15c/0x3b0\n     worker_thread+0x2d0/0x400\n     kthread+0x148/0x228\n     ret_from_fork+0x10/0x20\n    Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)\n    ---[ end trace 0000000000000000 ]---\n\nPrevent that by taking the actual allocated are into account when\nchecking for CPER length.\n\n[ rjw: Subject tweaks ]","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"APEI/GHES: ensure that won't go past CPER allocated record","id":"CVE-2026-43277","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"dm: clear cloned request bio pointer when last clone bio completes","id":"CVE-2026-43278"},"packages":[],"prev":{"headline":"net: mana: Fix double destroy_workqueue on service rescan PCI path","id":"CVE-2026-43276"},"products":["Linux"],"published":"2026-05-06","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A flaw in the Linux kernel APEI/GHES driver allows a bad firmware to cause a kernel OOPS via memory corruption, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2026-43277/"}