CVE-2026-43201

Vulnerability

A flaw in the Linux kernel's APEI/GHES (Generic Hardware Error Source) subsystem for ARM Processor Errors can lead to a system crash. The function log_arm_hw_error() iterates over error context information without verifying that the reported section_length or context info size fields stay within the allocated memory buffer. If a BIOS or firmware generates a very small or incomplete ARM Processor Error record, the kernel may read beyond the provided data, triggering an Oops (kernel panic) as shown in the reported crash trace [1].

Exploitation

An attacker with the ability to supply malformed ARM Processor Error records—typically through ACPI firmware tables or via GHESv2 notifications—can trigger the out-of-bounds read. No special privileges are required beyond the ability to influence the error data (e.g., via physical access or compromised firmware). The vulnerability can be exploited locally from kernel context, as the error handling runs in a workqueue (kworker) during ACPI notification processing.

Impact

Successful exploitation results in a denial of service (DoS) due to an Oops or kernel panic. The system crashes, potentially causing data loss or interruption of services. The crash message indicates an internal error at log_arm_hw_error+0x5c due to accessing invalid memory.

Mitigation

The fix adds proper bounds checks for err->section_length and ctx_info->size before using them as loop counters or pointer offsets. Patches have been applied to the Linux kernel stable trees; users should update to kernels containing the commits referenced in [1].