CVE-2026-45851: efi: Fix reservation of unaccepted memory table
In the Linux kernel, the following vulnerability has been resolved:
efi: Fix reservation of unaccepted memory table
The reserveunaccepted() function incorrectly calculates the size of the memblock reservation for the unaccepted memory table. It aligns the size of the table, but fails to account for cases where the table's starting physical address (efi.unaccepted) is not page-aligned.
If the table starts at an offset within a page and its end crosses into a subsequent page that the aligned size does not cover, the end of the table will not be reserved. This can lead to the table being overwritten or inaccessible, causing a kernel panic in acceptmemory().
This issue was observed when starting Intel TDX VMs with specific memory sizes (e.g., > 64GB).
Fix this by calculating the end address first (including the unaligned start) and then aligning it up, ensuring the entire range is covered by the reservation.
Affected Software
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
The issue was observed when starting Intel TDX virtual machines with specific memory sizes, for example greater than 64 GB. It depends on an unaccepted memory table whose physical start address is not page-aligned and whose range crosses into a page not covered by the incorrect reservation.
What is the operational impact if the affected memory table is not fully reserved?
Part of the unaccepted memory table can be overwritten or become inaccessible. This can cause a kernel panic in accept_memory().
Does exploitation require remote access or user interaction?
The supplied CVSS vector identifies the attack vector as local, requires low privileges, and requires no user interaction. The description specifically describes a kernel memory-reservation error during the affected VM startup conditions.