CVE-2026-43201

Description

In the Linux kernel, the following vulnerability has been resolved: APEI/GHES: ARM processor Error: don't go past allocated memory If the BIOS generates a very small ARM Processor Error, or an incomplete one, the current logic will fail to deferrence err->section_length and ctx_info->size Add checks to avoid that. With such changes, such GHESv2 records won't cause OOPSes like this: [ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP [ 1.495449] Modules linked in: [ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT [ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 [ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred [ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1.497199] pc : log_arm_hw_error+0x5c/0x200 [ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220 0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75). 70 err_info = (struct cper_arm_err_info *)(err + 1); 71 ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); 72 ctx_err = (u8 *)ctx_info; 73 74 for (n = 0; n < err->context_info_num; n++) { 75 sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; 76 ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); 77 ctx_len += sz; 78 } 79 and similar ones while trying to access section_length on an error dump with too small size. [ rjw: Subject tweaks ]

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel < 6.18

Linux Kernel stable branches before specific commits

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// Simulating the kernel structure handling
struct cper_arm_ctx_info {
    int size;
    // ... other fields ...
};

// Simulated vulnerable logic from drivers/ras/ras.c
void simulate_vulnerable_parse(struct cper_arm_ctx_info *ctx_info, int context_info_num, int buffer_size) {
    struct cper_arm_ctx_info *current = ctx_info;
    unsigned long ctx_len = 0;

    for (int n = 0; n < context_info_num; n++) {
        // Vulnerability: No check if (current + sz) exceeds allocated buffer_size
        int sz = sizeof(struct cper_arm_ctx_info) + current->size;
        
        // Move pointer based on untrusted size value
        current = (struct cper_arm_ctx_info *)((long)current + sz);
        ctx_len += sz;
        
        printf("Step %d: Pointer moved to %p, Total offset: %lu\n", n, current, ctx_len);
        
        // In a real kernel, accessing 'current' here if out of bounds causes an Oops/Panic
        if ((char *)current > (char *)ctx_info + buffer_size) {
            printf("[OOPS] Kernel panic: Out of bounds memory access!\n");
            break;
        }
    }
}

int main() {
    // Allocate a small buffer to simulate a valid BIOS error record area
    const int BUFFER_SIZE = 64;
    char *buffer = malloc(BUFFER_SIZE);
    memset(buffer, 0, BUFFER_SIZE);

    struct cper_arm_ctx_info *fake_record = (struct cper_arm_ctx_info *)buffer;
    
    // Exploit: Set a size that forces the pointer arithmetic to go past the buffer
    fake_record->size = 200; // Malicious large size
    
    printf("Triggering CVE-2026-43201 PoC simulation...\n");
    simulate_vulnerable_parse(fake_record, 1, BUFFER_SIZE);
    
    free(buffer);
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-43201
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-43201
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-43201/
[4] VulDB https://vuldb.com/cve/CVE-2026-43201
[5] https://git.kernel.org/stable/c/136093ba4161e0080088abff48273f6830a47766
[6] https://git.kernel.org/stable/c/242c652849d979d0133c315a42d9acea0ff88390
[7] https://git.kernel.org/stable/c/87880af2d24e62a84ed19943dbdd524f097172f2
[8] https://git.kernel.org/stable/c/db103b8bd3a4aca69b1b5fe8831a6ed75ac4b3bd

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-43201", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-06T12:16:39.223", "lastModified": "2026-05-11T20:20:33.693", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nAPEI/GHES: ARM processor Error: don't go past allocated memory\n\nIf the BIOS generates a very small ARM Processor Error, or\nan incomplete one, the current logic will fail to deferrence\n\n\terr->section_length\nand\n\tctx_info->size\n\nAdd checks to avoid that. With such changes, such GHESv2\nrecords won't cause OOPSes like this:\n\n[ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP\n[ 1.495449] Modules linked in:\n[ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT\n[ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022\n[ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred\n[ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 1.497199] pc : log_arm_hw_error+0x5c/0x200\n[ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220\n\n0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75).\n70\t\terr_info = (struct cper_arm_err_info *)(err + 1);\n71\t\tctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num);\n72\t\tctx_err = (u8 *)ctx_info;\n73\n74\t\tfor (n = 0; n < err->context_info_num; n++) {\n75\t\t\tsz = sizeof(struct cper_arm_ctx_info) + ctx_info->size;\n76\t\t\tctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);\n77\t\t\tctx_len += sz;\n78\t\t}\n79\n\nand similar ones while trying to access section_length on an\nerror dump with too small size.\n\n[ rjw: Subject tweaks ]"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.63", "versionEndExcluding": "6.12.75", "matchCriteriaId": "542D0F20-9BF3-4A6B-8A81-50EB66AF5488"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.2", "versionEndExcluding": "6.18.16", "matchCriteriaId": "2BC0F0F2-F832-46B8-8B2C-F20E038DF8FE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/136093ba4161e0080088abff48273f6830a47766", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/242c652849d979d0133c315a42d9acea0ff88390", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/87880af2d24e62a84ed19943dbdd524f097172f2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/db103b8bd3a4aca69b1b5fe8831a6ed75ac4b3bd", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}