CVE-2026-89588: Linux Kernel ACPI APEI Buffer Overflow

CVE-2026-89588 Overview

CVE-2026-89588 is an out-of-bounds read vulnerability in the Linux kernel's ACPI APEI GHES (Generic Hardware Error Source) subsystem. The flaw resides in ghes_handle_arm_hw_error(), which processes ARM hardware error records reported through the Common Platform Error Record (CPER) format. After skipping the cper_sec_proc_arm header, the function reduced the remaining length by sizeof(err) (pointer size) instead of sizeof(*err) (structure size). This miscalculation overestimates the bytes available for cper_arm_err_info records. The parser can then read past the end of the CPER section when err_info_num is large relative to error_data_length.

Critical Impact
A crafted or malformed ARM hardware error record processed through APEI GHES can trigger out-of-bounds reads in kernel memory, potentially leading to information disclosure, kernel instability, or denial of service.

Affected Products

Linux kernel versions containing the flawed length accounting in ghes_handle_arm_hw_error()
ARM64 systems using ACPI APEI GHES for hardware error reporting
Distributions shipping affected upstream kernel revisions prior to the fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89588 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89588

Vulnerability Analysis

The defect exists in the ACPI Platform Error Interface (APEI) Generic Hardware Error Source (GHES) handler for ARM processor errors. When firmware reports an ARM hardware error, the kernel parses a cper_sec_proc_arm structure followed by a variable number of cper_arm_err_info records. The handler advances its pointer past the header with err + 1, correctly moving sizeof(*err) bytes. However, the length counter tracking remaining section bytes is decremented by sizeof(err), which is the size of the pointer itself rather than the size of the structure it references.

On 64-bit ARM systems, sizeof(err) equals 8 bytes while sizeof(*err) is significantly larger. This mismatch causes the accounting variable to overstate how many bytes remain in the CPER section. Subsequent iteration through err_info_num records trusts this inflated length and can read beyond the allocated section boundary.

Root Cause

The root cause is a sizeof operator error, a common C programming defect where the size of a pointer is used in place of the size of the pointed-to structure. This is an Out-of-Bounds Read [CWE-125] defect stemming from incorrect boundary arithmetic. The earlier size validation in the function used sizeof(*err) correctly, but the post-header length adjustment did not match, breaking the invariant the check was intended to enforce.

Attack Vector

Exploitation requires local access with the ability to influence hardware error records processed by GHES. This typically requires privileged firmware interaction, a compromised BMC, malicious ACPI tables, or virtualization scenarios where a hypervisor injects crafted CPER records into a guest. An attacker who controls the err_info_num and error_data_length fields of a CPER record can trigger the parser to read adjacent kernel memory, potentially exposing sensitive kernel data or causing kernel faults.

No public proof-of-concept exploit is available for CVE-2026-89588, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream fix commits for the exact code change: kernel.org commit 452eb28e and kernel.org commit 903308ea.

Detection Methods for CVE-2026-89588

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ghes_handle_arm_hw_error or cper_estatus_print in dmesg
Repeated GHES error notifications with unusually large err_info_num values relative to the reported error_data_length
Kernel Address Sanitizer (KASAN) out-of-bounds read reports in the APEI GHES code path on ARM64 systems

Detection Strategies

Audit kernel version strings across ARM64 fleets and compare against the fix commits published on kernel.org
Enable KASAN in test environments to surface out-of-bounds reads in drivers/acpi/apei/ghes.c during firmware error handling
Monitor system logs for CPER parsing anomalies and correlate with firmware or hypervisor events that generate hardware error records

Monitoring Recommendations

Forward /var/log/kern.log and journald kernel messages to a centralized log platform for pattern analysis
Alert on kernel warnings and BUG traces originating from ACPI APEI subsystem functions
Track hypervisor logs where guests receive injected CPER records to detect abuse from a compromised host or peer VM

How to Mitigate CVE-2026-89588

Immediate Actions Required

Identify ARM64 hosts running kernels that predate the upstream fix and prioritize patching
Apply distribution kernel updates that incorporate the corrected length accounting in ghes_handle_arm_hw_error()
Restrict physical and firmware-level access to systems where GHES-reported errors could be attacker-influenced

Patch Information

The upstream fix replaces the erroneous sizeof(err) with sizeof(*err) so the remaining length accurately reflects the bytes consumed by the header. The patch is available across stable branches through the following commits: kernel.org commit 452eb28e, kernel.org commit 5ff385e9, kernel.org commit 903308ea, and kernel.org commit b48b6130. Rebuild and reboot into a patched kernel to activate the fix.

Workarounds

No supported workaround eliminates the flaw without patching; the vulnerable code path executes whenever GHES processes ARM hardware error records
In virtualized environments, restrict hypervisor injection of synthetic CPER records to trusted administrators only
Where feasible, disable APEI GHES notification sources that are not required by the platform to reduce exposure to malformed error records

bash

# Verify the running kernel version and check for the fix
uname -r

# Inspect recent GHES-related kernel messages
dmesg | grep -iE 'ghes|apei|cper'

# On Debian/Ubuntu, install the latest kernel and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-generic
sudo reboot

# On RHEL/Fedora systems
sudo dnf update kernel
sudo reboot