CVE-2026-90341

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table. A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header. Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table.

Severity

HIGH

CVSS score

7.7 (v3.1)

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-17 17:17:32.740000

Last modified

2026-10-19 09:19:28.117000

View original CVE JSON

{
  "id": "CVE-2026-90341",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-17T17:17:32.740",
  "lastModified": "2026-10-19T09:19:28.117",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: coreboot: Validate table bounds\n\nThe existing coreboot_table_populate() bounds checks limit individual\nentries to the mapped length.  However, coreboot_table_probe() replaces\nthe platform resource length with header and table sizes supplied by\nfirmware before mapping the full table.\n\nA malformed table can overflow the 32-bit size addition or advertise an\nextent beyond the resource, causing the driver to map and parse memory\noutside the resource.  A resource shorter than the fixed header is also\nmapped as though it contained a complete header.\n\nReject resources shorter than the fixed header.  After validating the\nsignature, require a complete header, calculate the advertised extent\nwith overflow checking, and reject extents beyond the resource before\nremapping the table."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/firmware/google/coreboot_table.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "3cca0d6dd4c2636d2514234233cb02db76621607",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "f79f621215a0944c4a0e1b3b86b99e433ae8c527",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "d848fac90c6f0566e7b93066b0b86024f65f395e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "88027241c1d2c3213bac937a1c2cb89a5775a413",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "fd93859ecfa5b6495a6863c18fd923a7666def26",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "2d98a3b89394f283f054a4a54587c14ee89acaf9",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "e82f260a74dea8cdd7857f2cc66f73d0da522bb3",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "a58a57a1076f8c5dae0327e3710899478c3be901",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/firmware/google/coreboot_table.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "4.12",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "4.12",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.270",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.221",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.188",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.157",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.110",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.52",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.6",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.2
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2d98a3b89394f283f054a4a54587c14ee89acaf9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3cca0d6dd4c2636d2514234233cb02db76621607",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/88027241c1d2c3213bac937a1c2cb89a5775a413",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a58a57a1076f8c5dae0327e3710899478c3be901",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d848fac90c6f0566e7b93066b0b86024f65f395e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e82f260a74dea8cdd7857f2cc66f73d0da522bb3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f79f621215a0944c4a0e1b3b86b99e433ae8c527",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fd93859ecfa5b6495a6863c18fd923a7666def26",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}