HIGH Introduced in 4.12
firmware CorebootTable OOB
CVE-2026-90341
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
KernelScan AI6.0MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table. A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header. Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table.
02KernelScan AI Analysis
Risk summary
A malformed coreboot table supplied by firmware can cause the kernel to map and read physical memory beyond the intended resource boundary, leaking kernel memory or crashing the system. Exploitation requires control of boot or firmware configuration, meaning an attacker needs either root access to modify ACPI/device-tree tables or physical access to reflash firmware. Systems with verified boot chains are protected because tampered firmware configuration is rejected before the vulnerable driver probes.
Vulnerability analysis
The coreboot table parser trusts size fields read from firmware-supplied memory without checking them against the actual resource bounds or for integer overflow. A malformed table can cause a size calculation to wrap around or claim a larger region than actually exists, leading the driver to map and read physical memory outside the intended region. A resource smaller than the fixed header is also wrongly accepted. The fix rejects undersized resources, validates the header is complete before using its fields, performs overflow-safe arithmetic when computing the total table size, and refuses to remap when the claimed extent exceeds the actual resource. The vulnerable path is reachable only when an attacker controls boot or firmware configuration — either through root-level modification of boot tables, or through physical access to reflash firmware — so systems with verified boot or kernel lockdown are protected.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 4.12 | 5.15.221 | f79f621215a0 |
| 6.12 | 4.12 | 6.12.110 | fd93859ecfa5 |
| 6.18 | 4.12 | 6.18.52 | 2d98a3b89394 |
| mainline | 4.12 | 7.3-rc1 | a58a57a1076f |
| 5.10 | 4.12 | 5.10.270 | 3cca0d6dd4c2 |
| 6.6 | 4.12 | 6.6.157 | 88027241c1d2 |
| 6.1 | 4.12 | 6.1.188 | d848fac90c6f |
| 7.2 | 4.12 | 7.2.6 | e82f260a74de |
| cip/6.12 | 4.12 | 6.12.111-cip32 | fd93859ecfa5 |