FKIE_CVE-2026-90341

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-18 18:17
Severity
7.7 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table. A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header. Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2d98a3b89394f283f054a4a54587c14ee89acaf9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3cca0d6dd4c2636d2514234233cb02db76621607
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/88027241c1d2c3213bac937a1c2cb89a5775a413
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a58a57a1076f8c5dae0327e3710899478c3be901
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d848fac90c6f0566e7b93066b0b86024f65f395e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e82f260a74dea8cdd7857f2cc66f73d0da522bb3
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f79f621215a0944c4a0e1b3b86b99e433ae8c527
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fd93859ecfa5b6495a6863c18fd923a7666def26
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/google/coreboot_table.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3cca0d6dd4c2636d2514234233cb02db76621607",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            },
            {
              "lessThan": "f79f621215a0944c4a0e1b3b86b99e433ae8c527",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            },
            {
              "lessThan": "d848fac90c6f0566e7b93066b0b86024f65f395e",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            },
            {
              "lessThan": "88027241c1d2c3213bac937a1c2cb89a5775a413",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            },
            {
              "lessThan": "fd93859ecfa5b6495a6863c18fd923a7666def26",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            },
            {
              "lessThan": "2d98a3b89394f283f054a4a54587c14ee89acaf9",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            },
            {
              "lessThan": "e82f260a74dea8cdd7857f2cc66f73d0da522bb3",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            },
            {
              "lessThan": "a58a57a1076f8c5dae0327e3710899478c3be901",
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/google/coreboot_table.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: coreboot: Validate table bounds\n\nThe existing coreboot_table_populate() bounds checks limit individual\nentries to the mapped length.  However, coreboot_table_probe() replaces\nthe platform resource length with header and table sizes supplied by\nfirmware before mapping the full table.\n\nA malformed table can overflow the 32-bit size addition or advertise an\nextent beyond the resource, causing the driver to map and parse memory\noutside the resource.  A resource shorter than the fixed header is also\nmapped as though it contained a complete header.\n\nReject resources shorter than the fixed header.  After validating the\nsignature, require a complete header, calculate the advertised extent\nwith overflow checking, and reject extents beyond the resource before\nremapping the table."
    }
  ],
  "id": "CVE-2026-90341",
  "lastModified": "2026-09-18T18:17:54.583",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.2,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-17T17:17:32.740",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2d98a3b89394f283f054a4a54587c14ee89acaf9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3cca0d6dd4c2636d2514234233cb02db76621607"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/88027241c1d2c3213bac937a1c2cb89a5775a413"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a58a57a1076f8c5dae0327e3710899478c3be901"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d848fac90c6f0566e7b93066b0b86024f65f395e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e82f260a74dea8cdd7857f2cc66f73d0da522bb3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f79f621215a0944c4a0e1b3b86b99e433ae8c527"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fd93859ecfa5b6495a6863c18fd923a7666def26"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.