GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89588 (GCVE-0-2026-89588)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:31
VLAI
Title
ACPI: APEI: GHES: fix ARM section length accounting after header
Summary
In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm header with (err + 1), the remaining length was reduced by sizeof(err) (pointer size) instead of sizeof(*err) (structure size). That overestimates the bytes left for cper_arm_err_info records and can let the parser read past the CPER section when err_info_num is large enough relative to error_data_length. Use sizeof(*err) so the length accounting matches the pointer advance and the earlier sizeof(*err) size check.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 242c652849d979d0133c315a42d9acea0ff88390 , < 5ff385e9403e87ae33f65b8c38698d3b1e92cfde (git)
Affected: 136093ba4161e0080088abff48273f6830a47766 , < 452eb28e03015abec6d4bf6488ee567706ade4e1 (git)
Affected: 87880af2d24e62a84ed19943dbdd524f097172f2 , < b48b613073c3d652cb1823c15d16f7067cf4cee4 (git)
Affected: 87880af2d24e62a84ed19943dbdd524f097172f2 , < 903308ea40adf0577d82eab69882faf8836326ce (git)
Affected: db103b8bd3a4aca69b1b5fe8831a6ed75ac4b3bd (git)
Affected: 6.12.75 , < 6.12.109 (semver)
Affected: 6.18.16 , < 6.18.50 (semver)
Affected: 6.19.6 , < 6.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/apei/ghes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5ff385e9403e87ae33f65b8c38698d3b1e92cfde",
              "status": "affected",
              "version": "242c652849d979d0133c315a42d9acea0ff88390",
              "versionType": "git"
            },
            {
              "lessThan": "452eb28e03015abec6d4bf6488ee567706ade4e1",
              "status": "affected",
              "version": "136093ba4161e0080088abff48273f6830a47766",
              "versionType": "git"
            },
            {
              "lessThan": "b48b613073c3d652cb1823c15d16f7067cf4cee4",
              "status": "affected",
              "version": "87880af2d24e62a84ed19943dbdd524f097172f2",
              "versionType": "git"
            },
            {
              "lessThan": "903308ea40adf0577d82eab69882faf8836326ce",
              "status": "affected",
              "version": "87880af2d24e62a84ed19943dbdd524f097172f2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "db103b8bd3a4aca69b1b5fe8831a6ed75ac4b3bd",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.109",
              "status": "affected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.50",
              "status": "affected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/apei/ghes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.12.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.18.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: APEI: GHES: fix ARM section length accounting after header\n\nIn ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm\nheader with (err + 1), the remaining length was reduced by sizeof(err)\n(pointer size) instead of sizeof(*err) (structure size).\n\nThat overestimates the bytes left for cper_arm_err_info records and can\nlet the parser read past the CPER section when err_info_num is large\nenough relative to error_data_length.\n\nUse sizeof(*err) so the length accounting matches the pointer advance\nand the earlier sizeof(*err) size check."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - GHES ARM processor CPER sections are consumed on the local host from ACPI APEI notifications (SCI, GSIV, GPIO, SEA, SDEI, NMI, or poll) via ghes_proc()/ghes_proc_in_irq() into ghes_handle_arm_hw_error(); there is no network or radio path. The most severe case is a local ARM server or VM whose firmware delivers a crafted ARM section.\nAC:L - After skipping the cper_sec_proc_arm header, remaining length was reduced by sizeof(pointer) (8) instead of sizeof(*err) (40), over-counting by 32 bytes. A recoverable ARM section with err_info_num large relative to error_data_length then deterministically parses past the section; no race or attacker-uncontrollable layout is required.\nPR:N - ghes_do_proc() and ghes_handle_arm_hw_error() apply no capability or credential check; firmware-first RAS notifications are processed in IRQ, NMI, or kworker context without a host login. Compromised ACPI/SDEI firmware or a BMC-written GHES status block needs no Linux account, matching other firmware-sourced kernel CNA scores.\nUI:N - GHES consumes the CPER record automatically on the notification and irq_work path. No victim action such as mounting a filesystem, opening a device node, or confirming a prompt is required.\nS:U - The out-of-bounds parse and any memory_failure() side effects remain in the host kernel that handles GHES. This is not a KVM/Xen guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - The inflated remaining length lets the parser read a cper_arm_err_info object past the CPER section. On the SEA/NMI path the estatus node is allocated to the exact CPER size, so this is a kernel gen_pool/heap out-of-bounds read of adjacent objects, including pointers.\nI:H - Out-of-bounds err_info fields are interpreted as a processor cache-error record; if type and validation_bits match, ghes_do_memory_failure() poisons err_info-\u003ephysical_fault_addr taken from adjacent memory. Firmware-controlled neighboring bytes thus yield a kernel integrity primitive via HWPoison of arbitrary PFNs.\nA:H - Reading past an exact-sized ghes_estatus_pool node can hit unmapped memory and oops, as the related ARM GHES parser already did on QEMU. memory_failure() of kernel pages or a large err_info_num walk in IRQ context can panic or hang, and notifications can be repeated."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:31:24.106Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5ff385e9403e87ae33f65b8c38698d3b1e92cfde"
        },
        {
          "url": "https://git.kernel.org/stable/c/452eb28e03015abec6d4bf6488ee567706ade4e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b48b613073c3d652cb1823c15d16f7067cf4cee4"
        },
        {
          "url": "https://git.kernel.org/stable/c/903308ea40adf0577d82eab69882faf8836326ce"
        }
      ],
      "title": "ACPI: APEI: GHES: fix ARM section length accounting after header",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89588",
    "datePublished": "2026-09-11T19:44:52.842Z",
    "dateReserved": "2026-09-11T19:38:34.729Z",
    "dateUpdated": "2026-09-13T06:31:24.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89588",
      "date": "2026-09-16",
      "epss": "0.00182",
      "percentile": "0.08059"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89588\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:43.300\",\"lastModified\":\"2026-09-13T07:17:24.623\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nACPI: APEI: GHES: fix ARM section length accounting after header\\n\\nIn ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm\\nheader with (err + 1), the remaining length was reduced by sizeof(err)\\n(pointer size) instead of sizeof(*err) (structure size).\\n\\nThat overestimates the bytes left for cper_arm_err_info records and can\\nlet the parser read past the CPER section when err_info_num is large\\nenough relative to error_data_length.\\n\\nUse sizeof(*err) so the length accounting matches the pointer advance\\nand the earlier sizeof(*err) size check.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/acpi/apei/ghes.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"242c652849d979d0133c315a42d9acea0ff88390\",\"lessThan\":\"5ff385e9403e87ae33f65b8c38698d3b1e92cfde\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"136093ba4161e0080088abff48273f6830a47766\",\"lessThan\":\"452eb28e03015abec6d4bf6488ee567706ade4e1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"87880af2d24e62a84ed19943dbdd524f097172f2\",\"lessThan\":\"b48b613073c3d652cb1823c15d16f7067cf4cee4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"87880af2d24e62a84ed19943dbdd524f097172f2\",\"lessThan\":\"903308ea40adf0577d82eab69882faf8836326ce\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"db103b8bd3a4aca69b1b5fe8831a6ed75ac4b3bd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.75\",\"lessThan\":\"6.12.109\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.18.16\",\"lessThan\":\"6.18.50\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.19.6\",\"lessThan\":\"6.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/acpi/apei/ghes.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/452eb28e03015abec6d4bf6488ee567706ade4e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5ff385e9403e87ae33f65b8c38698d3b1e92cfde\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/903308ea40adf0577d82eab69882faf8836326ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b48b613073c3d652cb1823c15d16f7067cf4cee4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T12:46:43+00:00",
      "cve": "CVE-2026-89588",
      "id": "CVE-2026-89588",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "262",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ACPI: APEI: GHES: fix ARM section length accounting after header",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89588.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.