CVE-2026-43201: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43201 Overview

CVE-2026-43201 is a Linux kernel vulnerability in the ACPI Platform Error Interface and Generic Hardware Error Source (APEI/GHES) subsystem. The flaw resides in the ARM processor error handling logic within drivers/ras/ras.c and ghes_handle_arm_hw_error(). When the BIOS produces a truncated or undersized ARM Processor Error record, the kernel dereferences err->section_length and ctx_info->size without validating that those fields fall within the allocated buffer. The result is an out-of-bounds read that triggers a kernel oops (Internal error: Oops: 0000000096000005).

Critical Impact
A malformed GHESv2 record supplied by firmware can crash the kernel through an out-of-bounds memory access in the ARM hardware error logging path, producing a denial of service.

Affected Products

Linux kernel APEI/GHES subsystem (ARM processor error handling)
drivers/ras/ras.clog_arm_hw_error() code path
Systems running affected Linux kernel versions on ARM platforms with GHESv2 firmware reporting

Discovery Timeline

2026-05-06 - CVE-2026-43201 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43201

Vulnerability Analysis

The issue is an out-of-bounds read [CWE-125] inside the kernel routine that logs ARM hardware errors reported through APEI/GHES. The kernel walks a sequence of Common Platform Error Record (CPER) structures using length fields embedded in the record itself. When firmware produces a record smaller than the structures the kernel expects, the parser advances pointers past the end of the allocated buffer and dereferences attacker-influenced memory. The reported oops occurs at log_arm_hw_error+0x5c/0x200, called from ghes_handle_arm_hw_error, while iterating over context_info_num entries.

Root Cause

The parser in log_arm_hw_error() computes err_info = (struct cper_arm_err_info *)(err + 1) and ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num) without checking that err->section_length is large enough to contain those structures. Inside the loop, sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size is read from memory that may lie beyond the allocated record. The fix adds bounds checks against the section length and context size before each dereference.

Attack Vector

Exploitation requires a crafted or faulty GHESv2 ARM Processor Error record produced by the platform firmware (BIOS) and consumed by the kernel through the kacpi_notify workqueue. A malicious or buggy firmware can deliver an undersized record that causes the kernel to read past the allocated buffer and panic. The vulnerability is reachable in the kernel error reporting path and does not require user-space interaction. The fix is contained in the upstream commits referenced in the Linux Kernel Commit 136093b, Linux Kernel Commit 242c652, Linux Kernel Commit 87880af, and Linux Kernel Commit db103b8 advisories.

No verified public exploit code is available. The vulnerability is described in prose only; refer to the upstream commits for the exact patched bounds checks.

Detection Methods for CVE-2026-43201

Indicators of Compromise

Kernel oops messages referencing log_arm_hw_error or ghes_handle_arm_hw_error in dmesg or /var/log/kern.log.
Repeated unexpected reboots or panics on ARM systems shortly after boot, originating from the kacpi_notify workqueue.
GHES error records logged through /sys/firmware/acpi/tables/ or rasdaemon showing truncated ARM processor error sections.

Detection Strategies

Monitor kernel logs for Internal error: Oops entries with program counter values inside log_arm_hw_error or ghes_handle_arm_hw_error.
Correlate ACPI/APEI error events with kernel panics to identify firmware-sourced malformed records.
Track installed kernel versions across the fleet and flag ARM hosts running pre-patch builds.

Monitoring Recommendations

Forward kernel ring buffer and rasdaemon output to a centralized logging or SIEM platform for analysis.
Alert on crash dumps generated by kdump that decode to symbols in the APEI/GHES code path.
Audit firmware versions on ARM hardware to identify systems known to emit malformed GHESv2 records.

How to Mitigate CVE-2026-43201

Immediate Actions Required

Update affected systems to a Linux kernel build that includes the upstream fixes referenced by commits 136093b, 242c652, 87880af, and db103b8.
Inventory ARM systems consuming firmware-reported hardware errors through APEI/GHES and prioritize them for patching.
Apply vendor-supplied firmware updates that correct generation of ARM Processor Error records.

Patch Information

The fix adds explicit checks so that err->section_length and ctx_info->size cannot be dereferenced beyond the allocated record. Patches are merged in the upstream Linux stable tree through commits 136093ba4161, 242c652849d9, 87880af2d24e, and db103b8bd3a4. Distribution kernels rebased on these stable releases include the fix; consult your distribution's security tracker for the exact package version.

Workarounds

If patching is delayed, restrict the system to firmware versions known to emit well-formed GHESv2 records.
On non-production ARM systems, consider disabling GHES reporting via kernel boot parameters where supported, accepting the loss of hardware error visibility.
Enable kdump to capture crash data so that any oops triggered by malformed records can be analyzed rather than causing silent reboots.

bash

# Verify running kernel includes the APEI/GHES fix
uname -r
grep -E 'log_arm_hw_error|ghes_handle_arm_hw_error' /proc/kallsyms
dmesg | grep -iE 'ghes|apei|arm processor error'