CVE-2026-89588

A flaw was found in the Linux kernel's Advanced Configuration and Power Interface (ACPI) APEI Generic Hardware Error Source (GHES) component. Incorrect length accounting in the ghes_handle_arm_hw_error() function can lead to the parser reading beyond the allocated memory section. This out-of-bounds read could potentially result in a denial of service or information disclosure.

An out-of-bounds read of moderate impact was found in the Linux kernel's ACPI APEI Generic Hardware Error Source (GHES) handling of ARM processor error records. In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm header, the remaining section length was reduced by sizeof(err) (the pointer size) instead of sizeof(*err) (the structure size). This overestimates the bytes available for cper_arm_err_info records, so when err_info_num is large enough relative to error_data_length the parser can read past the end of the CPER section, most likely causing a kernel panic (denial of service) and potentially disclosing adjacent kernel memory contents. Red Hat rates this flaw MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because triggering it depends on ACPI GHES firmware error reporting on ARM systems, which is a narrower exposure than the upstream CVEORG score of 8.4 implies. Red Hat Enterprise Linux kernel and kernel-rt streams and OpenShift 4.x RHCOS images are marked NOT AFFECTED because the vulnerable code is not present in them. OpenShift Container Platform 5.0 and 5.1 (ose-rhel-coreos-9) are affected, with the fix deferred to a future update of those streams; the residual risk there is that a firmware-reported GHES ARM error record with a mismatched err_info_num and error_data_length triggers the out-of-bounds read and crashes the kernel or leaks adjacent memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.