CVE-2026-43171

Description

In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't dump the entire memory region The current logic at cper_print_fw_err() doesn't check if the error record length is big enough to handle offset. On a bad firmware, if the ofset is above the actual record, length -= offset will underflow, making it dump the entire memory. The end result can be: - the logic taking a lot of time dumping large regions of memory; - data disclosure due to the memory dumps; - an OOPS, if it tries to dump an unmapped memory region. Fix it by checking if the section length is too small before doing a hex dump. [ rjw: Subject tweaks ]

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel (Multiple stable branches prior to specific commits)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * PoC for CVE-2026-43171 (Conceptual)
 * This code demonstrates the integer underflow logic present in
 * cper_print_fw_err(). It simulates the condition where the offset
 * is larger than the record length.
 */

#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>

void simulate_vulnerability(size_t record_len, size_t offset) {
    printf("[+] Simulating cper_print_fw_err logic\n");
    printf("    Record Length: %zu\n", record_len);
    printf("    Offset:        %zu\n", offset);

    // The vulnerable logic: length -= offset without bounds check
    size_t len_to_dump = record_len - offset;

    printf("    Calculated Dump Length: %zu\n", len_to_dump);

    if (len_to_dump > record_len) {
        printf("[!] Integer underflow detected!\n");
        printf("[!] Kernel would attempt to dump massive memory region.\n");
        printf("[!] Potential Impact: Information Disclosure, DoS (OOPS).\n");
    }
}

int main() {
    // Scenario: Malicious firmware provides an offset larger than the record
    size_t legitimate_len = 100;
    size_t malicious_offset = 200;

    simulate_vulnerability(legitimate_len, malicious_offset);
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-43171
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-43171
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-43171/
[4] VulDB https://vuldb.com/cve/CVE-2026-43171
[5] https://git.kernel.org/stable/c/02de64ab54b4bb0f1b21bb324aeff3b08612be33
[6] https://git.kernel.org/stable/c/0e09b522f2622841389c3b2f9ac4969e35c0809d
[7] https://git.kernel.org/stable/c/54e131db4cdffd946db890ff33ff2647053fd4f6
[8] https://git.kernel.org/stable/c/55cc6fe5716f678f06bcb95140882dfa684464ec
[9] https://git.kernel.org/stable/c/5a9b1dda8481b82851a655c3bcc5b44879b95334
[10] https://git.kernel.org/stable/c/64ae5aaa7ac93c83da456039e8ec747bfa8a7cff
[11] https://git.kernel.org/stable/c/7780c0bad2a3a70a8c0113a33c02f4151d901eb3
[12] https://git.kernel.org/stable/c/a8419f5f2c5f2d80848ddabb2b95cf0da84a5f91

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-43171", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-06T12:16:35.447", "lastModified": "2026-05-13T14:55:22.277", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEFI/CPER: don't dump the entire memory region\n\nThe current logic at cper_print_fw_err() doesn't check if the\nerror record length is big enough to handle offset. On a bad firmware,\nif the ofset is above the actual record, length -= offset will\nunderflow, making it dump the entire memory.\n\nThe end result can be:\n\n - the logic taking a lot of time dumping large regions of memory;\n - data disclosure due to the memory dumps;\n - an OOPS, if it tries to dump an unmapped memory region.\n\nFix it by checking if the section length is too small before doing\na hex dump.\n\n[ rjw: Subject tweaks ]"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-191"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartExcluding": "5.7", "versionEndExcluding": "5.10.252", "matchCriteriaId": "92C4581E-88B3-4AD3-AEE8-AA42DF330D60"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.202", "matchCriteriaId": "4002FC2B-1456-4666-B240-0EBF590C4671"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.165", "matchCriteriaId": "797C7F46-D0BE-4FB8-A502-C5EF8E6B6654"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.128", "matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.75", "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.16", "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:5.7:-:*:*:*:*:*:*", "matchCriteriaId": "3D23CE42-BDB2-4216-8495-230ABE98FCDD"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:5.7:rc7:*:*:*:*:*:*", "matchCriteriaId": "9D26AE9C-D49F-4FE9-8A6A-5A7199B7436E"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/02de64ab54b4bb0f1b21bb324aeff3b08612be33", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/0e09b522f2622841389c3b2f9ac4969e35c0809d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/54e131db4cdffd946db890ff33ff2647053fd4f6", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/55cc6fe5716f678f06bcb95140882dfa684464ec", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/5a9b1dda8481b82851a655c3bcc5b44879b95334", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/64ae5aaa7ac93c83da456039e8ec747bfa8a7cff", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/7780c0bad2a3a70a8c0113a33c02f4151d901eb3", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/a8419f5f2c5f2d80848ddabb2b95cf0da84a5f91", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}