CVE-2026-90341 (GCVE-0-2026-90341)
Vulnerability from cvelistv5 – Published: 2026-09-17 16:08 – Updated: 2026-10-19 09:01
VLAI
EPSS
VEX
Title
firmware: coreboot: Validate table bounds
Summary
In the Linux kernel, the following vulnerability has been resolved:
firmware: coreboot: Validate table bounds
The existing coreboot_table_populate() bounds checks limit individual
entries to the mapped length. However, coreboot_table_probe() replaces
the platform resource length with header and table sizes supplied by
firmware before mapping the full table.
A malformed table can overflow the 32-bit size addition or advertise an
extent beyond the resource, causing the driver to map and parse memory
outside the resource. A resource shorter than the fixed header is also
mapped as though it contained a complete header.
Reject resources shorter than the fixed header. After validating the
signature, require a complete header, calculate the advertised extent
with overflow checking, and reject extents beyond the resource before
remapping the table.
Severity
7.7 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < 3cca0d6dd4c2636d2514234233cb02db76621607
(git)
Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < f79f621215a0944c4a0e1b3b86b99e433ae8c527 (git) Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < d848fac90c6f0566e7b93066b0b86024f65f395e (git) Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < 88027241c1d2c3213bac937a1c2cb89a5775a413 (git) Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < fd93859ecfa5b6495a6863c18fd923a7666def26 (git) Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < 2d98a3b89394f283f054a4a54587c14ee89acaf9 (git) Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < e82f260a74dea8cdd7857f2cc66f73d0da522bb3 (git) Affected: d384d6f43d1ec3f1225ab0275fd592c5980bd830 , < a58a57a1076f8c5dae0327e3710899478c3be901 (git) |
guessed | |
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/google/coreboot_table.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3cca0d6dd4c2636d2514234233cb02db76621607",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
},
{
"lessThan": "f79f621215a0944c4a0e1b3b86b99e433ae8c527",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
},
{
"lessThan": "d848fac90c6f0566e7b93066b0b86024f65f395e",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
},
{
"lessThan": "88027241c1d2c3213bac937a1c2cb89a5775a413",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
},
{
"lessThan": "fd93859ecfa5b6495a6863c18fd923a7666def26",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
},
{
"lessThan": "2d98a3b89394f283f054a4a54587c14ee89acaf9",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
},
{
"lessThan": "e82f260a74dea8cdd7857f2cc66f73d0da522bb3",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
},
{
"lessThan": "a58a57a1076f8c5dae0327e3710899478c3be901",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/google/coreboot_table.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: coreboot: Validate table bounds\n\nThe existing coreboot_table_populate() bounds checks limit individual\nentries to the mapped length. However, coreboot_table_probe() replaces\nthe platform resource length with header and table sizes supplied by\nfirmware before mapping the full table.\n\nA malformed table can overflow the 32-bit size addition or advertise an\nextent beyond the resource, causing the driver to map and parse memory\noutside the resource. A resource shorter than the fixed header is also\nmapped as though it contained a complete header.\n\nReject resources shorter than the fixed header. After validating the\nsignature, require a complete header, calculate the advertised extent\nwith overflow checking, and reject extents beyond the resource before\nremapping the table."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The triggering fields are header-\u003eheader_bytes and header-\u003etable_bytes in the LBIO table, read by coreboot_table_probe() after platform_get_resource(pdev, IORESOURCE_MEM, 0) from ACPI GOOGCB00/BOOT0000 _CRS or the OF /firmware/coreboot reg; those bytes come from firmware, not a network protocol message.\nAC:L - coreboot_table_probe() replaces resource_size(res) with the u32 sum header_bytes+table_bytes before memremap() and coreboot_table_populate(); firmware that sets that sum past the ACPI/DT window, or a resource shorter than sizeof(*header), hits the over-map on every bind with no race.\nPR:N - coreboot_table_probe() is the coreboot_table platform_driver probe from subsys_initcall, with no capable() or credential check; a malformed LBIO header at the GOOGCB00/coreboot MEM resource is parsed automatically, so no Linux account or user-namespace capability is required.\nUI:N - Binding the GOOGCB00/BOOT0000 or compatible=\"coreboot\" platform device calls coreboot_table_probe() during boot or module load; the oversized memremap() happens on that probe with no mount, open, or other victim action.\nS:U - The oversized memremap() in coreboot_table_probe() and the memcpy() in coreboot_table_populate() stay in this kernel\u0027s coreboot table parser; this is not a KVM/Xen guest-to-host, IOMMU, or sandbox boundary crossing.\nC:H - memremap(res-\u003estart, header_bytes+table_bytes) then coreboot_table_populate() memcpy\u0027s each entry-\u003esize from that mapping into a kmalloc\u0027d coreboot_device; table_bytes is an unconstrained u32, so this is an unbounded over-read of physical memory past the ACPI/DT resource, not a few-byte leak.\nI:N - coreboot_table_populate() copies into kzalloc(sizeof(device-\u003edev)+entry-\u003esize) using the same entry-\u003esize already checked against the (oversize) mapping, so the destination matches the copy; this path has no out-of-bounds write or control-flow hijack primitive.\nA:H - try_ram_remap() in memremap() returns __va(res-\u003estart) after checking only the first pfn, so populate\u0027s walk of a table_bytes that extends past the reserved coreboot table/CBMEM window can fault on a linear-map hole or mixed RAM/MMIO range and oops or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:01:58.280Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3cca0d6dd4c2636d2514234233cb02db76621607"
},
{
"url": "https://git.kernel.org/stable/c/f79f621215a0944c4a0e1b3b86b99e433ae8c527"
},
{
"url": "https://git.kernel.org/stable/c/d848fac90c6f0566e7b93066b0b86024f65f395e"
},
{
"url": "https://git.kernel.org/stable/c/88027241c1d2c3213bac937a1c2cb89a5775a413"
},
{
"url": "https://git.kernel.org/stable/c/fd93859ecfa5b6495a6863c18fd923a7666def26"
},
{
"url": "https://git.kernel.org/stable/c/2d98a3b89394f283f054a4a54587c14ee89acaf9"
},
{
"url": "https://git.kernel.org/stable/c/e82f260a74dea8cdd7857f2cc66f73d0da522bb3"
},
{
"url": "https://git.kernel.org/stable/c/a58a57a1076f8c5dae0327e3710899478c3be901"
}
],
"title": "firmware: coreboot: Validate table bounds",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90341",
"datePublished": "2026-09-17T16:08:52.307Z",
"dateReserved": "2026-09-11T19:38:34.804Z",
"dateUpdated": "2026-10-19T09:01:58.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-90341",
"date": "2026-11-09",
"epss": "0.0019",
"percentile": "0.08739"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/google/coreboot_table.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3cca0d6dd4c2636d2514234233cb02db76621607",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
},
{
"lessThan": "f79f621215a0944c4a0e1b3b86b99e433ae8c527",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
},
{
"lessThan": "d848fac90c6f0566e7b93066b0b86024f65f395e",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
},
{
"lessThan": "88027241c1d2c3213bac937a1c2cb89a5775a413",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
},
{
"lessThan": "fd93859ecfa5b6495a6863c18fd923a7666def26",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
},
{
"lessThan": "2d98a3b89394f283f054a4a54587c14ee89acaf9",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
},
{
"lessThan": "e82f260a74dea8cdd7857f2cc66f73d0da522bb3",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
},
{
"lessThan": "a58a57a1076f8c5dae0327e3710899478c3be901",
"status": "affected",
"version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/google/coreboot_table.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: coreboot: Validate table bounds\n\nThe existing coreboot_table_populate() bounds checks limit individual\nentries to the mapped length. However, coreboot_table_probe() replaces\nthe platform resource length with header and table sizes supplied by\nfirmware before mapping the full table.\n\nA malformed table can overflow the 32-bit size addition or advertise an\nextent beyond the resource, causing the driver to map and parse memory\noutside the resource. A resource shorter than the fixed header is also\nmapped as though it contained a complete header.\n\nReject resources shorter than the fixed header. After validating the\nsignature, require a complete header, calculate the advertised extent\nwith overflow checking, and reject extents beyond the resource before\nremapping the table."
}
],
"id": "CVE-2026-90341",
"lastModified": "2026-10-19T09:19:28.117",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.5,
"impactScore": 5.2,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-09-17T17:17:32.740",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/2d98a3b89394f283f054a4a54587c14ee89acaf9"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/3cca0d6dd4c2636d2514234233cb02db76621607"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/88027241c1d2c3213bac937a1c2cb89a5775a413"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a58a57a1076f8c5dae0327e3710899478c3be901"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/d848fac90c6f0566e7b93066b0b86024f65f395e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/e82f260a74dea8cdd7857f2cc66f73d0da522bb3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/f79f621215a0944c4a0e1b3b86b99e433ae8c527"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/fd93859ecfa5b6495a6863c18fd923a7666def26"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-11-06T01:40:48+00:00",
"cve": "CVE-2026-90341",
"id": "CVE-2026-90341",
"initial_release_date": "2026-09-17T00:00:00+00:00",
"product_status:known_not_affected": "202",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: firmware: coreboot: Validate table bounds",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90341.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.