IT

Tracker / CVE-2026-53047

CVE-2026-53047

Medium 5.5

In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect sizeof in phys array reallocation The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be causing an undersized allocation. The allocation is also inconsistent with the initial array allocation in efi_capsule_open() that allocates one entry with sizeof(phys_addr_t), and the efi_capsule_write() function that stores phys_addr_t values (not pointers) via page_to_phys(). On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but pointers are 32-bit, this allocates half the required space, which might lead to a heap buffer overflow when storing physical addresses. This is similar to the bug fixed in commit fccfa646ef36 ("efi/capsule-loader: fix incorrect allocation size") which fixed the same issue at the initial allocation site.

Affected products and versions

linux linux_kernel
linux linux_kernel · 4.14.13 → 4.15
linux linux_kernel · 4.15.1 → 5.10.258
linux linux_kernel · 5.11 → 5.15.209
linux linux_kernel · 5.16 → 6.1.175
linux linux_kernel · 6.13 → 6.18.33
linux linux_kernel · 6.19 → 7.0.10
linux linux_kernel · 6.2 → 6.6.141
linux linux_kernel · 6.7 → 6.12.91

Analysis

This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.

References