CVE-2026-89588 ACPI: APEI: GHES: fix ARM section length accounting after header
A kernel bug in ACPI APEI GHES handling allows out-of-bounds reads, potentially leading to system crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89588?
CVE-2026-89588 is a high-severity memory corruption vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ACPI: APEI: GHES: fix ARM section length accounting after header
In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm header with (err + 1), the remaining length was reduced by sizeof(err) (pointer size) instead of sizeof(*err) (structure size).
That overestimates the bytes left for cper_arm_err_info records and can let the parser read past the CPER section when err_info_num is large enough relative to error_data_length.
Use sizeof(*err) so the length accounting matches the pointer advance and the earlier sizeof(*err) size check.
Which versions are affected by CVE-2026-89588?
How do I fix CVE-2026-89588?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-89588 being exploited?
There is no known exploitation of CVE-2026-89588 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-89588, DEBIAN-CVE-2026-89588, GHSA-rcxp-8r6g-r5jm, UBUNTU-CVE-2026-89588.