HIGH
acpi GhesArm OOB
CVE-2026-89588
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI4.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm header with (err + 1), the remaining length was reduced by sizeof(err) (pointer size) instead of sizeof(*err) (structure size). That overestimates the bytes left for cper_arm_err_info records and can let the parser read past the CPER section when err_info_num is large enough relative to error_data_length. Use sizeof(*err) so the length accounting matches the pointer advance and the earlier sizeof(*err) size check.
02KernelScan AI Analysis
Risk summary
An incorrect length calculation in the ACPI APEI GHES ARM processor error handler allows the kernel to read past the end of a firmware-supplied error record buffer. An attacker who can influence firmware or ACPI table content — via root access or physical tampering — can trigger an out-of-bounds read that may leak a small amount of kernel memory or cause a kernel oops. Only ARM platforms with ACPI/APEI/GHES support are affected.
Vulnerability analysis
When the kernel parses firmware-reported ARM processor hardware error records via ACPI APEI GHES, it skips past a header structure and subtracts the header's size from the remaining buffer length. The original code subtracted the size of a pointer (8 bytes) instead of the size of the actual header structure, which is much larger. This overestimate lets the parser iterate through more error-info entries than the buffer actually holds, reading kernel memory beyond the error record. The fix corrects the subtraction to use the structure size so the length accounting matches the pointer advance. The vulnerable path is reachable only on ARM platforms with ACPI/APEI/GHES support, and triggering it requires an attacker to supply a malformed error record — which means controlling firmware behavior through root-level ACPI table overrides or physical access to firmware.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.12.75 | 6.12.109 | 5ff385e9403e |
| 6.18 | 6.18.16 | 6.18.50 | 452eb28e0301 |
| 6.19 | 6.19.6 | 6.20 | b48b613073c3 |
| 7.2 | — | 7.2.4 | 903308ea40ad |
| mainline | — | 7.3 | — |
| cip/6.12 | — | 6.12.111-cip32 | 5ff385e9403e |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |