{"id":"CVE-2026-43201","title":"APEI/GHES: ARM processor Error: don't go past allocated memory","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nAPEI/GHES: ARM processor Error: don't go past allocated memory\n\nIf the BIOS generates a very small ARM Processor Error, or\nan incomplete one, the current logic will fai…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 2599ad5e33b629a78a14a463a51afa134e9c5b15 < 242c652849d979d0133c315a42d9acea0ff88390","Linux >= 22b5096abc9824fb84f0bfe084f5be9f7ea5f2d9 < 136093ba4161e0080088abff48273f6830a47766","Linux >= 05954511b73e748d0370549ad9dd9cd95297d97a < db103b8bd3a4aca69b1b5fe8831a6ed75ac4b3bd","Linux >= 05954511b73e748d0370549ad9dd9cd95297d97a < 87880af2d24e62a84ed19943dbdd524f097172f2","Linux 0aa7b12eaa87cd6ffa25d432d3c58986516f8b1c","Linux >= 6.12.63 < 6.12.75","Linux >= 6.18.2 < 6.18.16","Linux >= 6.17.13 < 6.18","Linux 6.19"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:30:43.529322Z"},"published":"2026-05-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:32:36.186Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43201","references":[{"url":"https://git.kernel.org/stable/c/242c652849d979d0133c315a42d9acea0ff88390"},{"url":"https://git.kernel.org/stable/c/136093ba4161e0080088abff48273f6830a47766"},{"url":"https://git.kernel.org/stable/c/db103b8bd3a4aca69b1b5fe8831a6ed75ac4b3bd"},{"url":"https://git.kernel.org/stable/c/87880af2d24e62a84ed19943dbdd524f097172f2"}],"tags":["cve.org"],"epss":0.00127,"epssPercentile":0.0243,"ingestedAt":"2026-11-06T15:54:04.008Z","slug":"CVE-2026-43201","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nAPEI/GHES: ARM processor Error: don't go past allocated memory\n\nIf the BIOS generates a very small ARM Processor Error, or\nan incomplete one, the current logic will fail to deferrence\n\n\terr->section_length\nand\n\tctx_info->size\n\nAdd checks to avoid that. With such changes, such GHESv2\nrecords won't cause OOPSes like this:\n\n[    1.492129] Internal error: Oops: 0000000096000005 [#1]  SMP\n[    1.495449] Modules linked in:\n[    1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT\n[    1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022\n[    1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred\n[    1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[    1.497199] pc : log_arm_hw_error+0x5c/0x200\n[    1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220\n\n0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75).\n70\t\terr_info = (struct cper_arm_err_info *)(err + 1);\n71\t\tctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num);\n72\t\tctx_err = (u8 *)ctx_info;\n73\n74\t\tfor (n = 0; n < err->context_info_num; n++) {\n75\t\t\tsz = sizeof(struct cper_arm_ctx_info) + ctx_info->size;\n76\t\t\tctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);\n77\t\t\tctx_len += sz;\n78\t\t}\n79\n\nand similar ones while trying to access section_length on an\nerror dump with too small size.\n\n[ rjw: Subject tweaks ]\n\n## Affected\n\n- `Linux >= 2599ad5e33b629a78a14a463a51afa134e9c5b15 < 242c652849d979d0133c315a42d9acea0ff88390`\n- `Linux >= 22b5096abc9824fb84f0bfe084f5be9f7ea5f2d9 < 136093ba4161e0080088abff48273f6830a47766`\n- `Linux >= 05954511b73e748d0370549ad9dd9cd95297d97a < db103b8bd3a4aca69b1b5fe8831a6ed75ac4b3bd`\n- `Linux >= 05954511b73e748d0370549ad9dd9cd95297d97a < 87880af2d24e62a84ed19943dbdd524f097172f2`\n- `Linux 0aa7b12eaa87cd6ffa25d432d3c58986516f8b1c`\n- `Linux >= 6.12.63 < 6.12.75`\n- `Linux >= 6.18.2 < 6.18.16`\n- `Linux >= 6.17.13 < 6.18`\n- `Linux 6.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}