CVE-2026-43171
EFI/CPER Memory Dump Flaw in Linux Kernel
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's EFI/CPER error handling logic, specifically in the function cper_print_fw_err(). The function does not properly check if the error record length is sufficient to handle an offset value. If the firmware is faulty and provides an offset that is larger than the actual error record, a length underflow occurs (length minus offset), causing the system to dump the entire memory region.
This improper handling can lead to excessive memory dumping, potentially exposing sensitive data or causing system instability.
How can this vulnerability impact me? :
The vulnerability can impact you in several ways:
- The system may spend a lot of time dumping large regions of memory, leading to performance degradation.
- Sensitive data could be disclosed due to the memory dumps, potentially exposing confidential information.
- An OOPS (kernel crash) may occur if the system attempts to dump an unmapped memory region, causing instability or downtime.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the fix has been applied. The fix involves checking if the section length is sufficient before performing a hex dump in the EFI/CPER error handling logic, preventing memory underflow and large memory dumps.
Avoid running untrusted or bad firmware that could trigger this issue, as it causes excessive memory dumping and potential data disclosure.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability can lead to data disclosure due to memory dumps caused by improper handling of error record lengths in the Linux kernel's EFI/CPER component.
Such unintended data disclosure could potentially impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive information from unauthorized access or leaks.
However, the provided information does not explicitly discuss compliance implications or specific regulatory impacts.