« Back to list

CVE-2026-90341

Status: ReceivedHigh (7.7)—

In the Linux kernel, the following vulnerability has been resolved:

firmware: coreboot: Validate table bounds

The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table.

A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header.

Read full descriptionShow less

Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vulnerabilidad local (AV:L) sin privilegios que permite leer memoria del kernel (C:H) y causar DoS (A:H) mediante tabla coreboot malformada. Acceso local a datos sensibles y denegación de servicio.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Threat Intelligence ProgramFilter Network TrafficExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Linux — Linux KernelAI

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-90341",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "3cca0d6dd4c2636d2514234233cb02db76621607",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "f79f621215a0944c4a0e1b3b86b99e433ae8c527",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "d848fac90c6f0566e7b93066b0b86024f65f395e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "88027241c1d2c3213bac937a1c2cb89a5775a413",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "fd93859ecfa5b6495a6863c18fd923a7666def26",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "2d98a3b89394f283f054a4a54587c14ee89acaf9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "e82f260a74dea8cdd7857f2cc66f73d0da522bb3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d384d6f43d1ec3f1225ab0275fd592c5980bd830",
              "lessThan": "a58a57a1076f8c5dae0327e3710899478c3be901",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/firmware/google/coreboot_table.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.12",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/firmware/google/coreboot_table.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:32.740",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2d98a3b89394f283f054a4a54587c14ee89acaf9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3cca0d6dd4c2636d2514234233cb02db76621607",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/88027241c1d2c3213bac937a1c2cb89a5775a413",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a58a57a1076f8c5dae0327e3710899478c3be901",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d848fac90c6f0566e7b93066b0b86024f65f395e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e82f260a74dea8cdd7857f2cc66f73d0da522bb3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f79f621215a0944c4a0e1b3b86b99e433ae8c527",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fd93859ecfa5b6495a6863c18fd923a7666def26",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: coreboot: Validate table bounds\n\nThe existing coreboot_table_populate() bounds checks limit individual\nentries to the mapped length.  However, coreboot_table_probe() replaces\nthe platform resource length with header and table sizes supplied by\nfirmware before mapping the full table.\n\nA malformed table can overflow the 32-bit size addition or advertise an\nextent beyond the resource, causing the driver to map and parse memory\noutside the resource.  A resource shorter than the fixed header is also\nmapped as though it contained a complete header.\n\nReject resources shorter than the fixed header.  After validating the\nsignature, require a complete header, calculate the advertised extent\nwith overflow checking, and reject extents beyond the resource before\nremapping the table."
    }
  ],
  "lastModified": "2026-09-18T18:17:54.583",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}