{
  "threat_severity" : "Moderate",
  "public_date" : "2026-05-06T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: EFI/CPER: don't go past the ARM processor CPER record buffer",
    "id" : "2467139",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2467139"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-130",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nEFI/CPER: don't go past the ARM processor CPER record buffer\nThere's a logic inside GHES/CPER to detect if the section_length\nis too small, but it doesn't detect if it is too big.\nCurrently, if the firmware receives an ARM processor CPER record\nstating that a section length is big, kernel will blindly trust\nsection_length, producing a very long dump. For instance, a 67\nbytes record with ERR_INFO_NUM set 46198 and section length\nset to 854918320 would dump a lot of data going a way past the\nfirmware memory-mapped area.\nFix it by adding a logic to prevent it to go past the buffer\nif ERR_INFO_NUM is too big, making it report instead:\n[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1\n[Hardware Error]: event severity: recoverable\n[Hardware Error]:  Error 0, type: recoverable\n[Hardware Error]:   section_type: ARM processor error\n[Hardware Error]:   MIDR: 0xff304b2f8476870a\n[Hardware Error]:   section length: 854918320, CPER size: 67\n[Hardware Error]:   section length is too big\n[Hardware Error]:   firmware-generated error record is incorrect\n[Hardware Error]:   ERR_INFO_NUM is 46198\n[ rjw: Subject and changelog tweaks ]", "A flaw was found in the Linux kernel's handling of Common Platform Error Records (CPER) for ARM processors. This vulnerability allows a local attacker or malicious firmware to provide a malformed CPER record with an excessively large section length. The kernel then attempts to read data beyond the intended memory buffer, which can lead to a system crash, causing a Denial of Service. This issue could also potentially disclose sensitive information from the kernel's memory." ],
  "statement" : "Red Hat acknowledges the upstream Linux kernel correction for «EFI/CPER» as described in COMMENT_ZERO. Fixes are delivered through standard kernel errata for supported products. Operational exposure depends on whether this subsystem or driver is active in your configuration.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-43266\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43266\nhttps://lore.kernel.org/linux-cve-announce/2026050608-CVE-2026-43266-506d@gregkh/T" ],
  "name" : "CVE-2026-43266",
  "csaw" : false
}