CVE-2026-53047: Linux EFI Capsule Loader Heap Buffer Overflow (32-bit PAE)

Technical summary

The __efi_capsule_setup_info() function in efi/capsule-loader calls krealloc() to expand the cap_info->phys array but incorrectly uses sizeof(phys_addr_t *) instead of sizeof(phys_addr_t). This is inconsistent with the initial allocation in efi_capsule_open() and the storage pattern in efi_capsule_write(), which both use and store phys_addr_t values directly. On 32-bit PAE systems where phys_addr_t is 64-bit but pointers are 32-bit, this results in an undersized heap allocation—allocating only half the required buffer—enabling a heap buffer overflow during physical address storage. The vulnerability mirrors a previously patched issue (commit fccfa646ef36) at the same subsystem's initial allocation site.

Business impact

This vulnerability poses a denial-of-service risk and potential privilege escalation on 32-bit PAE systems. An unprivileged local user with capsule-loader access could trigger a heap overflow, crash the kernel, corrupt memory, or potentially execute code with kernel privileges. Most modern deployments use 64-bit kernels and are unaffected, but legacy or embedded 32-bit deployments with PAE remain vulnerable and should be prioritized for patching.

Affected systems

The Linux kernel across all versions up to the fix. Practical impact is limited to 32-bit systems with PAE enabled (32-bit architecture with >4 GB address support). 64-bit Linux systems are not affected because sizeof(phys_addr_t) equals sizeof(phys_addr_t *) on 64-bit platforms, masking the bug. Systems must have EFI firmware and capsule loader functionality enabled.

Exploitability

Exploitation requires local access and the ability to interact with the EFI capsule loader interface (typically via /dev/efi_capsule_loader or similar). No authentication bypass is needed; an unprivileged local user with capsule-loader permissions can trigger the overflow by attempting to load a crafted capsule. The vulnerability is not remotely exploitable and requires intentional interaction with the capsule-loader subsystem.

Remediation

Apply a Linux kernel patch that corrects the sizeof argument in the krealloc() call from sizeof(phys_addr_t *) to sizeof(phys_addr_t). This ensures the heap allocation matches both the initial allocation size and the data type being stored. Verify the patch against your Linux vendor's advisory. Systems already running 64-bit kernels are not functionally impacted by this bug but should still patch for code correctness and to reduce attack surface.

Patch guidance

Monitor your Linux distribution or vendor for an official kernel update addressing CVE-2026-53047. The fix is a one-line correction to the sizeof operator in the krealloc() call within efi/capsule-loader. Apply updates according to your patching policy, prioritizing 32-bit PAE systems. Test patches in a staging environment before production deployment to ensure stability with your specific hardware and EFI configuration. Distributions typically backport fixes to stable and LTS kernel branches.

Detection guidance

Monitor kernel logs for heap corruption warnings, page faults, or out-of-bounds access messages related to the capsule-loader subsystem. Use dynamic analysis tools (KASAN, AddressSanitizer) on test systems to detect heap overflows during capsule loading. Check dmesg output for BUG or WARNING messages mentioning efi_capsule or phys allocation. In production, look for unexpected kernel crashes or memory corruption events coinciding with capsule-loader activity. Static analysis tools can identify the sizeof mismatch by comparing allocation and usage patterns.

Why prioritize this

Prioritize this vulnerability for 32-bit PAE systems where it poses a real heap overflow risk. For 64-bit deployments (the vast majority), prioritization is lower but not negligible—patch during normal maintenance cycles to maintain code hygiene and prevent future variants. The vulnerability's discovery on a modern system architecture and its similarity to a previously patched bug suggest careful review of related memory-allocation code patterns throughout the EFI subsystem.

Risk score, explained

CVSS 3.1 scores this as MEDIUM (5.5) due to local-only access requirement, lack of user interaction, and denial-of-service potential, offset by the limited exploitability window and architecture-specific nature. The vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects that while confidentiality and integrity are not directly compromised, availability can be severely impacted through heap corruption and kernel panic. The 'Medium' rating appropriately reflects that the vulnerability is serious on affected 32-bit systems but not universally critical.

Frequently asked questions