CVE-2026-97906: bootconfig: Fix integer overflow in initrd size check
bootconfig: Fix integer overflow in initrd size check
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In get_boot_config_from_initrd(), validate that bootconfig size does not exceed XBC_DATA_MAX or the available space between initrd_start and hdr before pointer subtraction; ensure the initrd is large enough to contain the bootconfig footer; and verify that hdr remains within the initrd bounds.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems that process a crafted initrd containing a bootconfig footer with an oversized size field are exposed. The described pointer wrap affects 32-bit systems, and 64-bit systems can also be affected when the initrd is larger than 4.29 GB.
What does an attacker need to trigger the failure?
An attacker needs to supply or cause the system to boot with a crafted initrd whose bootconfig size is extremely large, for example 0xFFFFFFFF. Exploitation occurs during early boot when the kernel processes the initrd.
What is the impact of successful triggering?
The kernel can bypass its intended initrd bounds check and attempt to checksum up to 4 GB of memory. Reading into unmapped memory can cause a fatal kernel page fault during early boot.
What validation does the fix add?
The fix verifies that the initrd can contain the bootconfig footer and that the footer is within initrd bounds. It also rejects sizes larger than XBC_DATA_MAX or larger than the space available between initrd_start and the footer before pointer subtraction occurs.