CVE-2026-89588

Last refreshed2026-10-19

Status: UPDATED | Advisory ID: CVE-2026-89588

Key Details

CVE	CVE-2026-89588
CVSS Score / Version	8.4 (High) / CVSS v3.1
Updated	2026-10-19
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

ACPI: APEI: GHES: fix ARM section length accounting after header

In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm

header with (err + 1), the remaining length was reduced by sizeof(err)

(pointer size) instead of sizeof(*err) (structure size).

That overestimates the bytes left for cper_arm_err_info records and can

let the parser read past the CPER section when err_info_num is large

enough relative to error_data_length.

Use sizeof(*err) so the length accounting matches the pointer advance

and the earlier sizeof(*err) size check. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-89588
CVE	https://www.cve.org/CVERecord?id=CVE-2026-89588

Source

Reference

NVD

CVE