CVE-2026-90341: firmware: coreboot: Validate table bounds
In the Linux kernel, the following vulnerability has been resolved:
firmware: coreboot: Validate table bounds
The existing coreboottablepopulate() bounds checks limit individual entries to the mapped length. However, coreboottableprobe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table.
A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header.
Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify/upgrade the Linux kernel coreboot firmware driver logic so coreboot_table_probe() rejects any coreboot table resource whose length is shorter than the fixed header (i.e., do not map/parse as if a complete header were present).
Linux kernel (coreboot firmware driver) coreboot_table_probe resource bounds validation = Reject resources shorter than the fixed header - Configuration
Modify/upgrade the Linux kernel coreboot firmware driver logic so that when validating the coreboot table signature/advertised extent, it calculates the advertised extent using header and table sizes with overflow checking, and rejects any extent that goes outside the platform resource length before mapping/remapping the table.
Linux kernel (coreboot firmware driver) coreboot_table_probe advertised extent validation = Reject extents beyond the resource with overflow checking
Event History
Frequently Asked Questions
Which systems are exposed?
Systems running the Linux kernel with the coreboot firmware table driver are exposed when the platform provides a malformed coreboot table or a resource that is shorter than the required fixed header.
What would an attacker need to exploit this?
An attacker would need to cause the kernel to process firmware-supplied coreboot table metadata with invalid header or table sizes. The malformed values must either overflow the 32-bit extent calculation or describe data beyond the platform resource.
What does the fix validate?
The fix rejects resources shorter than the fixed header, requires a complete header after signature validation, checks the advertised extent for arithmetic overflow, and rejects tables whose extent exceeds the resource before remapping.