CVE-2026-43277

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the APEI/GHES component where the ghes new() function fails to properly validate the size of CPER records. While the logic prevents allocating records larger than GHES ESTATUS MAX SIZE (64KB), the actual allocation is based on the number of pages from the CPER bios table location, which may be smaller. Consequently, malicious firmware could send data exceeding the allocated memory, leading to a kernel OOPS (a type of kernel panic or crash).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.