Memory Allocation Vulnerability in Linux Kernel Affects Multiple Configurations

CVE-2026-43277

What is CVE-2026-43277?

A vulnerability in the Linux Kernel's handling of APEI/GHES can lead to memory allocation errors when firmware sends overly large data records. The function 'ghes_new()' currently allocates memory based on CPER bios records, but faulty firmware can send larger data than the allocated size. This discrepancy could cause a kernel OOPS, ultimately resulting in system instability or crashes. Mitigating this issue involves adjusting allocation logic to ensure memory boundaries are respected and do not exceed expected limits.

References