CVE-2026-89588: ACPI: APEI: GHES: fix ARM section length accounting after header
In the Linux kernel, the following vulnerability has been resolved:
ACPI: APEI: GHES: fix ARM section length accounting after header
In gheshandlearmhwerror(), after skipping the cpersecprocarm header with (err + 1), the remaining length was reduced by sizeof(err) (pointer size) instead of sizeof(err) (structure size).
That overestimates the bytes left for cperarmerrinfo records and can let the parser read past the CPER section when errinfonum is large enough relative to errordatalength.
Use sizeof(err) so the length accounting matches the pointer advance and the earlier sizeof(err) size check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems that process ARM processor hardware-error sections through the ACPI APEI GHES path are relevant. The issue is triggered while parsing CPER section data containing ARM error-information records.
How can I verify that the correction is present in source code?
In ghes_handle_arm_hw_error(), after advancing past the header with err + 1, the remaining length must be reduced by sizeof(*err), not sizeof(err). The corrected accounting should match the pointer advance and the existing sizeof(*err) size check.