CVE-2026-53047: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53047 Overview

CVE-2026-53047 is a Linux kernel vulnerability in the EFI capsule loader subsystem. The flaw exists in __efi_capsule_setup_info() where a krealloc() call for the cap_info->phys array uses sizeof(phys_addr_t *) instead of sizeof(phys_addr_t). On 32-bit systems with Physical Address Extension (PAE), where phys_addr_t is 64-bit but pointers are 32-bit, this miscalculation allocates only half the required memory. The undersized allocation can lead to a heap buffer overflow when storing physical addresses. The issue mirrors a previously fixed bug in commit fccfa646ef36 that addressed the same flaw at the initial allocation site.

Critical Impact
A heap buffer overflow in kernel space can corrupt adjacent slab objects, enabling local privilege escalation or kernel memory disclosure on affected 32-bit PAE Linux systems.

Affected Products

Linux kernel versions containing the flawed krealloc() call in drivers/firmware/efi/capsule-loader.c
32-bit Linux systems with PAE enabled where sizeof(phys_addr_t) != sizeof(phys_addr_t *)
Distributions shipping unpatched stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-06-24 - CVE-2026-53047 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53047

Vulnerability Analysis

The Linux kernel EFI capsule loader exposes /dev/efi_capsule_loader to allow userspace to deliver firmware capsule updates. When a process writes capsule data, the kernel accumulates the physical addresses of pinned pages in a dynamically grown array referenced by cap_info->phys. The __efi_capsule_setup_info() function reallocates this array using krealloc() to accommodate additional entries as more capsule data arrives.

The array stores values of type phys_addr_t, not pointers to phys_addr_t. The reallocation logic, however, sizes the new buffer using sizeof(phys_addr_t *). On 64-bit systems both types are eight bytes, so the bug is latent. On 32-bit kernels built with PAE, phys_addr_t is 64 bits while pointers remain 32 bits, producing an allocation half the size required.

This inconsistency is classified as a heap-based buffer overflow [CWE-122]. Subsequent writes through efi_capsule_write() store phys_addr_t values past the end of the allocated slab object.

Root Cause

The root cause is a type confusion between a value and a pointer to that value in a sizeof expression. The initial allocation in efi_capsule_open() correctly uses sizeof(phys_addr_t). The reallocation path diverged and used the pointer type, breaking the invariant that each array slot holds one phys_addr_t value derived from page_to_phys().

Attack Vector

Exploitation requires local access with permission to open the EFI capsule loader device. An attacker on a 32-bit PAE kernel writes a crafted sequence of capsule data sized to force reallocation of the phys array. Because the reallocated buffer is undersized, subsequent stores of physical address values overflow into adjacent slab memory. Skilled attackers can groom the SLUB allocator to place sensitive kernel objects next to the undersized buffer, then corrupt function pointers or reference counts to achieve privilege escalation.

The vulnerability manifests in the capsule loader reallocation path. See the upstream commits listed under Detection Methods for the precise patch diff.

Detection Methods for CVE-2026-53047

Indicators of Compromise

Unexpected kernel oops or BUG: KASAN: slab-out-of-bounds messages referencing __efi_capsule_setup_info or efi_capsule_write
Non-root processes opening /dev/efi_capsule_loader on 32-bit PAE hosts where firmware update workflows do not exist
Kernel log entries showing repeated capsule write operations from unprivileged userspace contexts

Detection Strategies

Enable CONFIG_KASAN on test kernels to catch the out-of-bounds write at runtime during fuzzing
Audit installed kernel package versions against the upstream stable trees referenced in the fix commits (22022cd, 48a4282, 5e18533, 608e1f7, 67adde6, 8be69e9, ab3f709, e0e6b14)
Use endpoint telemetry to identify processes that open the capsule loader character device outside firmware update tooling

Monitoring Recommendations

Forward kernel ring buffer events to a centralized log store and alert on slab corruption signatures
Track which user IDs invoke open() on /dev/efi_capsule_loader and correlate with firmware update windows
Monitor for unscheduled reboots or firmware update activity on 32-bit PAE deployments

How to Mitigate CVE-2026-53047

Immediate Actions Required

Apply the upstream Linux stable kernel updates that correct the sizeof expression in __efi_capsule_setup_info()
Restrict access to /dev/efi_capsule_loader to root only and confirm udev rules do not relax default permissions
Inventory 32-bit PAE Linux hosts since these are the systems at risk of the heap overflow

Patch Information

The fix replaces sizeof(phys_addr_t *) with sizeof(phys_addr_t) in the krealloc() call inside __efi_capsule_setup_info(), aligning the reallocation with the initial allocation in efi_capsule_open(). The patch is distributed across multiple stable branches via the kernel.org commits referenced above. Distribution maintainers should rebuild kernel packages from a tree containing one of these commits and publish updated images.

Workarounds

Disable the EFI capsule loader by unloading or blacklisting the efi_capsule_loader module where firmware updates are not required
Remove the capsule loader device node or set its permissions to 0600 owned by root
Migrate 32-bit PAE workloads to 64-bit kernels where the bug is latent and cannot be triggered

bash

# Blacklist the capsule loader module until the kernel is patched
echo 'blacklist efi_capsule_loader' | sudo tee /etc/modprobe.d/blacklist-efi-capsule.conf
sudo rmmod efi_capsule_loader 2>/dev/null || true
sudo chmod 600 /dev/efi_capsule_loader 2>/dev/null || true