CVE-2026-43171

Vulnerability

The cper_print_fw_err() function in the Linux kernel's EFI/ CPER (Common Platform Error Record) handling lacks a validation check for the error record length relative to the offset. When a malformed firmware record is processed, the subtraction length -= offset can underflow if the offset exceeds the actual record length, resulting in a huge positive value. This causes the subsequent hex dump routine to attempt to read and print an enormous memory region.

Exploitation

An attacker who can supply a crafted UEFI CPER record—for example, through physical access or a compromised firmware—can trigger this vulnerability. No special privileges are required beyond the ability to influence the error record that the kernel processes. The underflow leads to uncontrolled memory reads from arbitrary kernel addresses.

Impact

The consequences include: excessive time spent dumping large memory regions, potentially causing a denial of service; disclosure of sensitive kernel memory contents (data disclosure); and a kernel OOPS if the attempted dump targets an unmapped memory region. The CVSS v3 score of 5.5 (Medium) reflects the potential for information disclosure and availability impact.

Mitigation

The fix adds a check to verify that the section length is sufficient before performing the hex dump, preventing the underflow. Patches have been applied to stable kernel trees [1][2][3][4]. Users should update to the latest stable kernel version to remediate this issue.