CVE-2026-89588

An out-of-bounds read of moderate impact was found in the Linux kernel's ACPI APEI Generic Hardware Error Source (GHES) handling of ARM processor error records. In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm header, the remaining section length was reduced by sizeof(err) (the pointer size) instead of sizeof(*err) (the structure size). This overestimates the bytes available for cper_arm_err_info records, so when err_info_num is large enough relative to error_data_length the parser can read past the end of the CPER section, most likely causing a kernel panic (denial of service) and potentially disclosing adjacent kernel memory contents. Red Hat rates this flaw MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because triggering it depends on ACPI GHES firmware error reporting on ARM systems, which is a narrower exposure than the upstream CVEORG score of 8.4 implies. Red Hat Enterprise Linux kernel and kernel-rt streams and OpenShift 4.x RHCOS images are marked NOT AFFECTED because the vulnerable code is not present in them. OpenShift Container Platform 5.0 and 5.1 (ose-rhel-coreos-9) are affected, with the fix deferred to a future update of those streams; the residual risk there is that a firmware-reported GHES ARM error record with a mismatched err_info_num and error_data_length triggers the out-of-bounds read and crashes the kernel or leaks adjacent memory.