CVE-2026-97906: bootconfig: Fix integer overflow in initrd size check
In the Linux kernel, the following vulnerability has been resolved:
bootconfig: Fix integer overflow in initrd size check
Sashiko reported that in getbootconfigfrominitrd(), a crafted initrd with a huge bootconfig size (such as 0xFFFFFFFF) can cause the pointer arithmetic:
data = ((void )hdr) - size;
to wrap around on 32-bit systems (or when pointer subtraction overflows). Because data wraps around, the subsequent bounds check:
if ((unsigned long)data < initrdstart)
evaluates to false, bypassing the check. The kernel then calls xbccalcchecksum(data, size), which attempts to read 4GB of memory, hitting unmapped pages and triggering a fatal kernel page fault during early boot. Furthermore, on 64-bit systems with an initrd > 4.29 GB, an unbounded 32-bit size can similarly bypass the initrdstart check.
Fix this by: 1. Ensuring the initrd is at least large enough to contain the bootconfig footer and verifying hdr is within the initrd bounds. 2. Checking that size does not exceed XBCDATAMAX and does not exceed the available space between initrdstart and hdr before performing pointer subtraction.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems that process a crafted initrd containing a bootconfig footer with an oversized size field are exposed. The described pointer wrap affects 32-bit systems, and 64-bit systems can also be affected when the initrd is larger than 4.29 GB.
What does an attacker need to trigger the failure?
An attacker needs to supply or cause the system to boot with a crafted initrd whose bootconfig size is extremely large, for example 0xFFFFFFFF. Exploitation occurs during early boot when the kernel processes the initrd.
What is the impact of successful triggering?
The kernel can bypass its intended initrd bounds check and attempt to checksum up to 4 GB of memory. Reading into unmapped memory can cause a fatal kernel page fault during early boot.
What validation does the fix add?
The fix verifies that the initrd can contain the bootconfig footer and that the footer is within initrd bounds. It also rejects sizes larger than XBC_DATA_MAX or larger than the space available between initrd_start and the footer before pointer subtraction occurs.