CVE-2026-43277: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43277 Overview

CVE-2026-43277 is a Linux kernel vulnerability in the ACPI Platform Error Interface (APEI) Generic Hardware Error Source (GHES) subsystem. The flaw resides in ghes_new(), where size validation against GHES_ESTATUS_MAX_SIZE (64KB) does not account for the actual number of pages allocated from the Common Platform Error Record (CPER) BIOS table. A malformed firmware response can supply a record larger than the allocated buffer, triggering an out-of-bounds read during cper_estatus_print_section() and producing a kernel OOPS. The issue affects systems that consume hardware error records through the ACPI Hardware Error Device (HED) notification path.

Critical Impact
A bad firmware payload can cause the Linux kernel to access memory past the allocated CPER record, leading to a kernel paging fault and denial of service.

Affected Products

Linux kernel APEI/GHES subsystem
Distributions shipping affected stable kernel branches prior to the referenced fixes
Systems exposing ACPI HED hardware error notifications, including virtualized environments such as QEMU

Discovery Timeline

2026-05-06 - CVE-2026-43277 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43277

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the kernel's APEI/GHES error reporting path. The ghes_new() function checks whether the reported CPER record size exceeds GHES_ESTATUS_MAX_SIZE, currently set to 64KB. However, the underlying buffer is allocated based on the page count derived from the CPER BIOS table location, which can be smaller than the size declared by firmware.

When firmware later delivers an error record larger than the allocated buffer, downstream consumers iterate past the buffer boundary. The crash trace shows the fault occurring in hex_dump_to_buffer() invoked from cper_estatus_print_section() and __ghes_print_estatus() during ghes_proc(). The result is a level 3 translation fault and kernel OOPS on the kworker thread handling acpi_hed_notify.

Root Cause

The root cause is an inconsistent size check. The validation gate compares the record size against a static maximum, but it does not compare against the dynamically computed allocation length. This mismatch creates a condition where a record passes validation while still exceeding the actual buffer.

Attack Vector

Exploitation requires firmware capable of supplying CPER records that misreport their size. In practice, this is reachable through compromised, buggy, or malicious BIOS or virtual firmware. A hypervisor-level attacker controlling guest firmware could trigger the condition inside a Linux guest, as demonstrated in the QEMU virtual machine reproduction in the public crash trace. The vulnerability does not enable remote network exploitation by default.

The fix, distributed across kernel commits including 616c120d, 6f5d4198, 92ba7907, 98bd9b28, b6be51a1, e0ec9911, f3740a15, and fa2408a2, ensures that the actual allocated area is taken into account when validating CPER length. See the Linux Kernel Commit 616c120d for the upstream change.

Detection Methods for CVE-2026-43277

Indicators of Compromise

Kernel OOPS messages referencing hex_dump_to_buffer, cper_estatus_print_section, or __ghes_print_estatus in dmesg or /var/log/messages.
Repeated Unable to handle kernel paging request faults originating from the kacpi_notify workqueue.
Unexpected reboots or kernel panics on systems following firmware updates or migration to new hypervisor builds.

Detection Strategies

Monitor kernel ring buffer output for fault traces in the GHES notification path and correlate with ACPI HED activity.
Inventory running kernel versions across Linux fleets and compare against the patched commits in the stable trees.
Track BIOS, UEFI, and virtual firmware versions in the asset inventory to identify systems that received firmware updates likely to deliver malformed CPER records.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and create alerts for GHES, CPER, and acpi_hed_notify fault signatures.
Add health checks for unexpected kworker terminations tied to kacpi_notify.
Review hypervisor firmware emulation logs for anomalous hardware error injection events.

How to Mitigate CVE-2026-43277

Immediate Actions Required

Upgrade affected systems to a Linux kernel build that includes the upstream fix from the referenced stable commits.
Validate firmware, BIOS, and UEFI versions on physical hosts and update to vendor-supported releases.
For virtualized workloads, update the hypervisor and any emulated firmware components that produce ACPI error records.

Patch Information

The upstream fix is distributed across multiple stable branches. Reference commits include Linux Kernel Commit 6f5d4198, Linux Kernel Commit 92ba7907, Linux Kernel Commit 98bd9b28, Linux Kernel Commit b6be51a1, Linux Kernel Commit e0ec9911, Linux Kernel Commit f3740a15, and Linux Kernel Commit fa2408a2. Apply the kernel package from your distribution that incorporates these commits and reboot to activate the patched kernel.

Workarounds

Restrict access to firmware update channels and hypervisor management planes to trusted administrators only.
Where feasible, disable verbose CPER record printing or limit GHES debug output to reduce exposure of the affected print path.
Validate vendor firmware signatures before deployment to lower the risk of malformed error records reaching the kernel.

bash

# Verify the running kernel version and confirm patched build is installed
uname -r

# On Debian/Ubuntu, install the latest patched kernel and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot

# On RHEL/CentOS/Rocky, update the kernel package
sudo dnf update kernel
sudo reboot

# Inspect kernel logs for prior GHES faults
sudo dmesg | grep -iE 'ghes|cper|acpi_hed'