---
id: CVE-2026-89588
title: 'ACPI: APEI: GHES: fix ARM section length accounting after header'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ACPI: APEI: GHES: fix ARM section length accounting after header

  In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm
  header with (err + 1), the remaini…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-125
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 242c652849d979d0133c315a42d9acea0ff88390 <
    5ff385e9403e87ae33f65b8c38698d3b1e92cfde
  - >-
    Linux >= 136093ba4161e0080088abff48273f6830a47766 <
    452eb28e03015abec6d4bf6488ee567706ade4e1
  - >-
    Linux >= 87880af2d24e62a84ed19943dbdd524f097172f2 <
    b48b613073c3d652cb1823c15d16f7067cf4cee4
  - >-
    Linux >= 87880af2d24e62a84ed19943dbdd524f097172f2 <
    903308ea40adf0577d82eab69882faf8836326ce
  - Linux db103b8bd3a4aca69b1b5fe8831a6ed75ac4b3bd
  - Linux >= 6.12.75 < 6.12.109
  - Linux >= 6.18.16 < 6.18.50
  - Linux >= 6.19.6 < 6.20
  - Linux 7.0
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:49:20.945Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89588'
references:
  - url: 'https://git.kernel.org/stable/c/5ff385e9403e87ae33f65b8c38698d3b1e92cfde'
  - url: 'https://git.kernel.org/stable/c/452eb28e03015abec6d4bf6488ee567706ade4e1'
  - url: 'https://git.kernel.org/stable/c/b48b613073c3d652cb1823c15d16f7067cf4cee4'
  - url: 'https://git.kernel.org/stable/c/903308ea40adf0577d82eab69882faf8836326ce'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89588.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89588'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532442'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89588'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89588'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89588.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00185
epssPercentile: 0.08012
scores:
  cna: 8.4
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.474Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ACPI: APEI: GHES: fix ARM section length accounting after header

In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm
header with (err + 1), the remaining length was reduced by sizeof(err)
(pointer size) instead of sizeof(*err) (structure size).

That overestimates the bytes left for cper_arm_err_info records and can
let the parser read past the CPER section when err_info_num is large
enough relative to error_data_length.

Use sizeof(*err) so the length accounting matches the pointer advance
and the earlier sizeof(*err) size check.

## Affected

- `Linux >= 242c652849d979d0133c315a42d9acea0ff88390 < 5ff385e9403e87ae33f65b8c38698d3b1e92cfde`
- `Linux >= 136093ba4161e0080088abff48273f6830a47766 < 452eb28e03015abec6d4bf6488ee567706ade4e1`
- `Linux >= 87880af2d24e62a84ed19943dbdd524f097172f2 < b48b613073c3d652cb1823c15d16f7067cf4cee4`
- `Linux >= 87880af2d24e62a84ed19943dbdd524f097172f2 < 903308ea40adf0577d82eab69882faf8836326ce`
- `Linux db103b8bd3a4aca69b1b5fe8831a6ed75ac4b3bd`
- `Linux >= 6.12.75 < 6.12.109`
- `Linux >= 6.18.16 < 6.18.50`
- `Linux >= 6.19.6 < 6.20`
- `Linux 7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 6 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89588.json)