CVE-2026-90341 firmware: coreboot: Validate table bounds
A malformed coreboot table can cause an integer overflow, leading to out-of-bounds memory access and potential code execution or denial of service in the Linux kernel.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90341?
CVE-2026-90341 is a high-severity vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
firmware: coreboot: Validate table bounds
The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table.
A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header.
Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table.
Which versions are affected by CVE-2026-90341?
How do I fix CVE-2026-90341?
Apply the vendor's patch.
Is CVE-2026-90341 being exploited?
There is no known exploitation of CVE-2026-90341 in the wild and no public exploit code.
Sources
Also known as AZL-101927, BELL-CVE-2026-90341, DEBIAN-CVE-2026-90341, GHSA-24q3-gvvv-jw93, UBUNTU-CVE-2026-90341.