CVE-2026-90341 (GCVE-0-2026-90341)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:08 – Updated: 2026-09-18 17:54
VLAI
Title
firmware: coreboot: Validate table bounds
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table. A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header. Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table.
Severity
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < 3cca0d6dd4c2636d2514234233cb02db76621607 (git)
Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < f79f621215a0944c4a0e1b3b86b99e433ae8c527 (git)
Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < d848fac90c6f0566e7b93066b0b86024f65f395e (git)
Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < 88027241c1d2c3213bac937a1c2cb89a5775a413 (git)
Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < fd93859ecfa5b6495a6863c18fd923a7666def26 (git)
Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < 2d98a3b89394f283f054a4a54587c14ee89acaf9 (git)
Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < e82f260a74dea8cdd7857f2cc66f73d0da522bb3 (git)
Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < a58a57a1076f8c5dae0327e3710899478c3be901 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/google/coreboot_table.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3cca0d6dd4c2636d2514234233cb02db76621607",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            },
            {
              "lessThan": "f79f621215a0944c4a0e1b3b86b99e433ae8c527",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            },
            {
              "lessThan": "d848fac90c6f0566e7b93066b0b86024f65f395e",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            },
            {
              "lessThan": "88027241c1d2c3213bac937a1c2cb89a5775a413",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            },
            {
              "lessThan": "fd93859ecfa5b6495a6863c18fd923a7666def26",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            },
            {
              "lessThan": "2d98a3b89394f283f054a4a54587c14ee89acaf9",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            },
            {
              "lessThan": "e82f260a74dea8cdd7857f2cc66f73d0da522bb3",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            },
            {
              "lessThan": "a58a57a1076f8c5dae0327e3710899478c3be901",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/google/coreboot_table.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: coreboot: Validate table bounds\n\nThe existing coreboot_table_populate() bounds checks limit individual\nentries to the mapped length.  However, coreboot_table_probe() replaces\nthe platform resource length with header and table sizes supplied by\nfirmware before mapping the full table.\n\nA malformed table can overflow the 32-bit size addition or advertise an\nextent beyond the resource, causing the driver to map and parse memory\noutside the resource.  A resource shorter than the fixed header is also\nmapped as though it contained a complete header.\n\nReject resources shorter than the fixed header.  After validating the\nsignature, require a complete header, calculate the advertised extent\nwith overflow checking, and reject extents beyond the resource before\nremapping the table."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The triggering fields are header-\u003eheader_bytes and header-\u003etable_bytes in the LBIO table, read by coreboot_table_probe() after platform_get_resource(pdev, IORESOURCE_MEM, 0) from ACPI GOOGCB00/BOOT0000 _CRS or the OF /firmware/coreboot reg; those bytes come from firmware, not a network protocol message.\nAC:L - coreboot_table_probe() replaces resource_size(res) with the u32 sum header_bytes+table_bytes before memremap() and coreboot_table_populate(); firmware that sets that sum past the ACPI/DT window, or a resource shorter than sizeof(*header), hits the over-map on every bind with no race.\nPR:N - coreboot_table_probe() is the coreboot_table platform_driver probe from subsys_initcall, with no capable() or credential check; a malformed LBIO header at the GOOGCB00/coreboot MEM resource is parsed automatically, so no Linux account or user-namespace capability is required.\nUI:N - Binding the GOOGCB00/BOOT0000 or compatible=\"coreboot\" platform device calls coreboot_table_probe() during boot or module load; the oversized memremap() happens on that probe with no mount, open, or other victim action.\nS:U - The oversized memremap() in coreboot_table_probe() and the memcpy() in coreboot_table_populate() stay in this kernel\u0027s coreboot table parser; this is not a KVM/Xen guest-to-host, IOMMU, or sandbox boundary crossing.\nC:H - memremap(res-\u003estart, header_bytes+table_bytes) then coreboot_table_populate() memcpy\u0027s each entry-\u003esize from that mapping into a kmalloc\u0027d coreboot_device; table_bytes is an unconstrained u32, so this is an unbounded over-read of physical memory past the ACPI/DT resource, not a few-byte leak.\nI:N - coreboot_table_populate() copies into kzalloc(sizeof(device-\u003edev)+entry-\u003esize) using the same entry-\u003esize already checked against the (oversize) mapping, so the destination matches the copy; this path has no out-of-bounds write or control-flow hijack primitive.\nA:H - try_ram_remap() in memremap() returns __va(res-\u003estart) after checking only the first pfn, so populate\u0027s walk of a table_bytes that extends past the reserved coreboot table/CBMEM window can fault on a linear-map hole or mixed RAM/MMIO range and oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:43.963Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3cca0d6dd4c2636d2514234233cb02db76621607"
        },
        {
          "url": "https://git.kernel.org/stable/c/f79f621215a0944c4a0e1b3b86b99e433ae8c527"
        },
        {
          "url": "https://git.kernel.org/stable/c/d848fac90c6f0566e7b93066b0b86024f65f395e"
        },
        {
          "url": "https://git.kernel.org/stable/c/88027241c1d2c3213bac937a1c2cb89a5775a413"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd93859ecfa5b6495a6863c18fd923a7666def26"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d98a3b89394f283f054a4a54587c14ee89acaf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e82f260a74dea8cdd7857f2cc66f73d0da522bb3"
        },
        {
          "url": "https://git.kernel.org/stable/c/a58a57a1076f8c5dae0327e3710899478c3be901"
        }
      ],
      "title": "firmware: coreboot: Validate table bounds",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90341",
    "datePublished": "2026-09-17T16:08:52.307Z",
    "dateReserved": "2026-09-11T19:38:34.804Z",
    "dateUpdated": "2026-09-18T17:54:43.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90341",
      "date": "2026-09-25",
      "epss": "0.0019",
      "percentile": "0.07737"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/firmware/google/coreboot_table.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3cca0d6dd4c2636d2514234233cb02db76621607",
                    "status": "affected",
                    "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f79f621215a0944c4a0e1b3b86b99e433ae8c527",
                    "status": "affected",
                    "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d848fac90c6f0566e7b93066b0b86024f65f395e",
                    "status": "affected",
                    "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "88027241c1d2c3213bac937a1c2cb89a5775a413",
                    "status": "affected",
                    "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fd93859ecfa5b6495a6863c18fd923a7666def26",
                    "status": "affected",
                    "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2d98a3b89394f283f054a4a54587c14ee89acaf9",
                    "status": "affected",
                    "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e82f260a74dea8cdd7857f2cc66f73d0da522bb3",
                    "status": "affected",
                    "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a58a57a1076f8c5dae0327e3710899478c3be901",
                    "status": "affected",
                    "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/firmware/google/coreboot_table.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.12"
                  },
                  {
                    "lessThan": "4.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: coreboot: Validate table bounds\n\nThe existing coreboot_table_populate() bounds checks limit individual\nentries to the mapped length.  However, coreboot_table_probe() replaces\nthe platform resource length with header and table sizes supplied by\nfirmware before mapping the full table.\n\nA malformed table can overflow the 32-bit size addition or advertise an\nextent beyond the resource, causing the driver to map and parse memory\noutside the resource.  A resource shorter than the fixed header is also\nmapped as though it contained a complete header.\n\nReject resources shorter than the fixed header.  After validating the\nsignature, require a complete header, calculate the advertised extent\nwith overflow checking, and reject extents beyond the resource before\nremapping the table."
          }
        ],
        "id": "CVE-2026-90341",
        "lastModified": "2026-09-18T18:17:54.583",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:32.740",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2d98a3b89394f283f054a4a54587c14ee89acaf9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3cca0d6dd4c2636d2514234233cb02db76621607"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/88027241c1d2c3213bac937a1c2cb89a5775a413"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a58a57a1076f8c5dae0327e3710899478c3be901"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d848fac90c6f0566e7b93066b0b86024f65f395e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e82f260a74dea8cdd7857f2cc66f73d0da522bb3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f79f621215a0944c4a0e1b3b86b99e433ae8c527"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fd93859ecfa5b6495a6863c18fd923a7666def26"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.