https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 21:48:55 +0000 https://db.gcve.eu/vuln/cve-2026-53047 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>efi/capsule-loader: fix incorrect sizeof in phys array reallocation</p> <p>The krealloc() call for cap_info-&gt;phys in __efi_capsule_setup_info() uses sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be causing an undersized allocation.</p> <p>The allocation is also inconsistent with the initial array allocation in efi_capsule_open() that allocates one entry with sizeof(phys_addr_t), and the efi_capsule_write() function that stores phys_addr_t values (not pointers) via page_to_phys().</p> <p>On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but pointers are 32-bit, this allocates half the required space, which might lead to a heap buffer overflow when storing physical addresses.</p> <p>This is similar to the bug fixed in commit fccfa646ef36 (&#34;efi/capsule-loader: fix incorrect allocation size&#34;) which fixed the same issue at the initial allocation site.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>efi/capsule-loader: fix incorrect sizeof in phys array reallocation</p> <p>The krealloc() call for cap_info-&gt;phys in __efi_capsule_setup_info() uses sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be causing an undersized allocation.</p> <p>The allocation is also inconsistent with the initial array allocation in efi_capsule_open() that allocates one entry with sizeof(phys_addr_t), and the efi_capsule_write() function that stores phys_addr_t values (not pointers) via page_to_phys().</p> <p>On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but pointers are 32-bit, this allocates half the required space, which might lead to a heap buffer overflow when storing physical addresses.</p> <p>This is similar to the bug fixed in commit fccfa646ef36 (&#34;efi/capsule-loader: fix incorrect allocation size&#34;) which fixed the same issue at the initial allocation site.</p> https://db.gcve.eu/vuln/cve-2026-53047