---
id: CVE-2026-43201
title: 'APEI/GHES: ARM processor Error: don''t go past allocated memory'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  APEI/GHES: ARM processor Error: don't go past allocated memory

  If the BIOS generates a very small ARM Processor Error, or
  an incomplete one, the current logic will fai…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2599ad5e33b629a78a14a463a51afa134e9c5b15 <
    242c652849d979d0133c315a42d9acea0ff88390
  - >-
    Linux >= 22b5096abc9824fb84f0bfe084f5be9f7ea5f2d9 <
    136093ba4161e0080088abff48273f6830a47766
  - >-
    Linux >= 05954511b73e748d0370549ad9dd9cd95297d97a <
    db103b8bd3a4aca69b1b5fe8831a6ed75ac4b3bd
  - >-
    Linux >= 05954511b73e748d0370549ad9dd9cd95297d97a <
    87880af2d24e62a84ed19943dbdd524f097172f2
  - Linux 0aa7b12eaa87cd6ffa25d432d3c58986516f8b1c
  - Linux >= 6.12.63 < 6.12.75
  - Linux >= 6.18.2 < 6.18.16
  - Linux >= 6.17.13 < 6.18
  - Linux 6.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:30:43.529322Z'
published: '2026-05-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:36.186Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43201'
references:
  - url: 'https://git.kernel.org/stable/c/242c652849d979d0133c315a42d9acea0ff88390'
  - url: 'https://git.kernel.org/stable/c/136093ba4161e0080088abff48273f6830a47766'
  - url: 'https://git.kernel.org/stable/c/db103b8bd3a4aca69b1b5fe8831a6ed75ac4b3bd'
  - url: 'https://git.kernel.org/stable/c/87880af2d24e62a84ed19943dbdd524f097172f2'
tags:
  - cve.org
epss: 0.00127
epssPercentile: 0.0243
ingestedAt: '2026-11-06T15:54:04.008Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

APEI/GHES: ARM processor Error: don't go past allocated memory

If the BIOS generates a very small ARM Processor Error, or
an incomplete one, the current logic will fail to deferrence

	err->section_length
and
	ctx_info->size

Add checks to avoid that. With such changes, such GHESv2
records won't cause OOPSes like this:

[    1.492129] Internal error: Oops: 0000000096000005 [#1]  SMP
[    1.495449] Modules linked in:
[    1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT
[    1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
[    1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred
[    1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[    1.497199] pc : log_arm_hw_error+0x5c/0x200
[    1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220

0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75).
70		err_info = (struct cper_arm_err_info *)(err + 1);
71		ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num);
72		ctx_err = (u8 *)ctx_info;
73
74		for (n = 0; n < err->context_info_num; n++) {
75			sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size;
76			ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
77			ctx_len += sz;
78		}
79

and similar ones while trying to access section_length on an
error dump with too small size.

[ rjw: Subject tweaks ]

## Affected

- `Linux >= 2599ad5e33b629a78a14a463a51afa134e9c5b15 < 242c652849d979d0133c315a42d9acea0ff88390`
- `Linux >= 22b5096abc9824fb84f0bfe084f5be9f7ea5f2d9 < 136093ba4161e0080088abff48273f6830a47766`
- `Linux >= 05954511b73e748d0370549ad9dd9cd95297d97a < db103b8bd3a4aca69b1b5fe8831a6ed75ac4b3bd`
- `Linux >= 05954511b73e748d0370549ad9dd9cd95297d97a < 87880af2d24e62a84ed19943dbdd524f097172f2`
- `Linux 0aa7b12eaa87cd6ffa25d432d3c58986516f8b1c`
- `Linux >= 6.12.63 < 6.12.75`
- `Linux >= 6.18.2 < 6.18.16`
- `Linux >= 6.17.13 < 6.18`
- `Linux 6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.