« Volver al listado

CVE-2026-90341

Estado: RecibidaAlta (7.7)—

In the Linux kernel, the following vulnerability has been resolved:

firmware: coreboot: Validate table bounds

The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table.

A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header.

Leer descripción completaMostrar menos

Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad local (AV:L) sin privilegios que permite leer memoria del kernel (C:H) y causar DoS (A:H) mediante tabla coreboot malformada. Acceso local a datos sensibles y denegación de servicio.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramFilter Network TrafficExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90341",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "3cca0d6dd4c2636d2514234233cb02db76621607",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "f79f621215a0944c4a0e1b3b86b99e433ae8c527",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "d848fac90c6f0566e7b93066b0b86024f65f395e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "88027241c1d2c3213bac937a1c2cb89a5775a413",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "fd93859ecfa5b6495a6863c18fd923a7666def26",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "2d98a3b89394f283f054a4a54587c14ee89acaf9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "e82f260a74dea8cdd7857f2cc66f73d0da522bb3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "a58a57a1076f8c5dae0327e3710899478c3be901",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/firmware/google/coreboot_table.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.12",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/firmware/google/coreboot_table.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:32.740",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2d98a3b89394f283f054a4a54587c14ee89acaf9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3cca0d6dd4c2636d2514234233cb02db76621607",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/88027241c1d2c3213bac937a1c2cb89a5775a413",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a58a57a1076f8c5dae0327e3710899478c3be901",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d848fac90c6f0566e7b93066b0b86024f65f395e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e82f260a74dea8cdd7857f2cc66f73d0da522bb3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f79f621215a0944c4a0e1b3b86b99e433ae8c527",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fd93859ecfa5b6495a6863c18fd923a7666def26",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: coreboot: Validate table bounds\n\nThe existing coreboot_table_populate() bounds checks limit individual\nentries to the mapped length.  However, coreboot_table_probe() replaces\nthe platform resource length with header and table sizes supplied by\nfirmware before mapping the full table.\n\nA malformed table can overflow the 32-bit size addition or advertise an\nextent beyond the resource, causing the driver to map and parse memory\noutside the resource.  A resource shorter than the fixed header is also\nmapped as though it contained a complete header.\n\nReject resources shorter than the fixed header.  After validating the\nsignature, require a complete header, calculate the advertised extent\nwith overflow checking, and reject extents beyond the resource before\nremapping the table."
    }
  ],
  "lastModified": "2026-09-18T18:17:54.583",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}