CVE-2026-53047 efi/capsule-loader: fix incorrect sizeof in phys array reallocation
Incorrect memory allocation size in the Linux kernel EFI capsule loader can cause heap buffer overflow on 32-bit PAE systems, potentially allowing code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53047?
CVE-2026-53047 is a medium-severity memory corruption vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
efi/capsule-loader: fix incorrect sizeof in phys array reallocation
The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be causing an undersized allocation.
The allocation is also inconsistent with the initial array allocation in efi_capsule_open() that allocates one entry with sizeof(phys_addr_t), and the efi_capsule_write() function that stores phys_addr_t values (not pointers) via page_to_phys().
On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but pointers are 32-bit, this allocates half the required space, which might lead to a heap buffer overflow when storing physical addresses.
This is similar to the bug fixed in commit fccfa646ef36 ("efi/capsule-loader: fix incorrect allocation size") which fixed the same issue at the initial allocation site.
Which versions are affected by CVE-2026-53047?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53047?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-53047 being exploited?
There is no known exploitation of CVE-2026-53047 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53047, DEBIAN-CVE-2026-53047, GHSA-jp44-vj5f-4fr8, ROOT-OS-DEBIAN-11-CVE-2026-53047, ROOT-OS-DEBIAN-12-CVE-2026-53047, ROOT-OS-UBUNTU-2204-CVE-2026-53047 and 2 more.