CVE-2026-90341: firmware: coreboot: Validate table bounds

CVE-2026-90341: firmware: coreboot: Validate table bounds

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

firmware: coreboot: Validate table bounds

The existing coreboot_table_populate() bounds checks limit individual
entries to the mapped length.  However, coreboot_table_probe() replaces
the platform resource length with header and table sizes supplied by
firmware before mapping the full table.

A malformed table can overflow the 32-bit size addition or advertise an
extent beyond the resource, causing the driver to map and parse memory
outside the resource.  A resource shorter than the fixed header is also
mapped as though it contained a complete header.

Reject resources shorter than the fixed header.  After validating the
signature, require a complete header, calculate the advertised extent
with overflow checking, and reject extents beyond the resource before
remapping the table.

The Linux kernel CVE team has assigned CVE-2026-90341 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.12 with commit d384d6f43d1ec3f1225ab0275fd592c5980bd830 and fixed in 5.10.270 with commit 3cca0d6dd4c2636d2514234233cb02db76621607
	Issue introduced in 4.12 with commit d384d6f43d1ec3f1225ab0275fd592c5980bd830 and fixed in 5.15.221 with commit f79f621215a0944c4a0e1b3b86b99e433ae8c527
	Issue introduced in 4.12 with commit d384d6f43d1ec3f1225ab0275fd592c5980bd830 and fixed in 6.1.188 with commit d848fac90c6f0566e7b93066b0b86024f65f395e
	Issue introduced in 4.12 with commit d384d6f43d1ec3f1225ab0275fd592c5980bd830 and fixed in 6.6.157 with commit 88027241c1d2c3213bac937a1c2cb89a5775a413
	Issue introduced in 4.12 with commit d384d6f43d1ec3f1225ab0275fd592c5980bd830 and fixed in 6.12.110 with commit fd93859ecfa5b6495a6863c18fd923a7666def26
	Issue introduced in 4.12 with commit d384d6f43d1ec3f1225ab0275fd592c5980bd830 and fixed in 6.18.52 with commit 2d98a3b89394f283f054a4a54587c14ee89acaf9
	Issue introduced in 4.12 with commit d384d6f43d1ec3f1225ab0275fd592c5980bd830 and fixed in 7.2.6 with commit e82f260a74dea8cdd7857f2cc66f73d0da522bb3
	Issue introduced in 4.12 with commit d384d6f43d1ec3f1225ab0275fd592c5980bd830 and fixed in 7.3-rc1 with commit a58a57a1076f8c5dae0327e3710899478c3be901

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-90341
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/firmware/google/coreboot_table.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3cca0d6dd4c2636d2514234233cb02db76621607
	https://git.kernel.org/stable/c/f79f621215a0944c4a0e1b3b86b99e433ae8c527
	https://git.kernel.org/stable/c/d848fac90c6f0566e7b93066b0b86024f65f395e
	https://git.kernel.org/stable/c/88027241c1d2c3213bac937a1c2cb89a5775a413
	https://git.kernel.org/stable/c/fd93859ecfa5b6495a6863c18fd923a7666def26
	https://git.kernel.org/stable/c/2d98a3b89394f283f054a4a54587c14ee89acaf9
	https://git.kernel.org/stable/c/e82f260a74dea8cdd7857f2cc66f73d0da522bb3
	https://git.kernel.org/stable/c/a58a57a1076f8c5dae0327e3710899478c3be901