UBUNTU-CVE-2026-90120: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Check getlogicalindex() return value in MADT IAFFID parsing In gicacpiparseiaffid() a given MADT GICC entry might not correspond to a logical cpu recognized by the kernel, resulting in the cpu variable initialization to an error value. Currently, the getlogicalindex() return value is not checked for failure, which might result in out-of-bounds memory corruption while trying to index a percpu variable array. Add a check to evaluate getlogicalindex() return value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Check the return value of get_logical_index() in gic_acpi_parse_iaffid() before indexing the per-CPU variable array, and handle failure when a MADT GICC entry does not correspond to a recognized logical CPU.
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
Systems running one of the listed Ubuntu kernel packages may be affected if they boot using ACPI MADT data containing a GICC entry that does not map to a logical CPU recognized by the kernel. The affected code path is in GICv5 MADT IAFFID parsing.
Does exploitation require an authenticated user or interaction?
The supplied severity vector indicates local attack vector, low attack complexity, no privileges required, and no user interaction. The provided data does not describe how an attacker would control or influence the relevant ACPI MADT entries.
What is the impact if the vulnerable path is reached?
Failure to validate the logical CPU index can cause out-of-bounds memory corruption when indexing a per-CPU variable array. The severity vector rates confidentiality, integrity, and availability impacts as high.
How can I determine whether a system is affected?
Check whether the system is running any of the listed Ubuntu kernel packages and whether it includes the fix that checks the get_logical_index() return value during MADT IAFFID parsing. No fixed package versions or detection commands are provided in the available data.