Skip to content
Heist/ feed
Back to feed
HighFix available

firmware: coreboot: Validate table bounds

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table. A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header. Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table.

Products
Kernel
Affected versions
Not specified
Fixed versions
5.10.270, 5.15.221, 6.1.188, 6.12.110, 6.18.52, 6.6.157, 7.2.6
CVEs
CVE-2026-90341
Confirmed fixed CVEs
Not specified
Updated in this feed
6 Nov 2026, 00:28 UTC · Revision 1

Source evidence

firmware: coreboot: Validate table bounds

core-osv · Original source

Published 17 Sept 2026, 16:08 UTC

In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table. A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header. Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table.

osv:CVE-2026-90341

Kernel

Fixed versions: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6

Complete source record
{
  "id": "ba20062f33e8d47e40d6bd5f8df71985268669c6d8d92acc0e003b2d6686bcaf",
  "url": "https://osv.dev/vulnerability/CVE-2026-90341",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "firmware: coreboot: Validate table bounds",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table. A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header. Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table.",
    "evidence": "osv:CVE-2026-90341",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.270",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.221",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.188",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.157",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.110",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.52",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.2.6",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-90341",
      "aliases": [
        "CVE-2026-90341"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "d384d6f43d1ec3f1225ab0275fd592c5980bd830"
                },
                {
                  "fixed": "3cca0d6dd4c2636d2514234233cb02db76621607"
                },
                {
                  "fixed": "f79f621215a0944c4a0e1b3b86b99e433ae8c527"
                },
                {
                  "fixed": "d848fac90c6f0566e7b93066b0b86024f65f395e"
                },
                {
                  "fixed": "88027241c1d2c3213bac937a1c2cb89a5775a413"
                },
                {
                  "fixed": "fd93859ecfa5b6495a6863c18fd923a7666def26"
                },
                {
                  "fixed": "2d98a3b89394f283f054a4a54587c14ee89acaf9"
                },
                {
                  "fixed": "e82f260a74dea8cdd7857f2cc66f73d0da522bb3"
                },
                {
                  "fixed": "a58a57a1076f8c5dae0327e3710899478c3be901"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90341.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.12.0"
                },
                {
                  "fixed": "5.10.270"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.221"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.188"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.157"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.110"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.52"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.2.6"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90341.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:45.432148839Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/2d98a3b89394f283f054a4a54587c14ee89acaf9",
        "https://git.kernel.org/stable/c/3cca0d6dd4c2636d2514234233cb02db76621607",
        "https://git.kernel.org/stable/c/88027241c1d2c3213bac937a1c2cb89a5775a413",
        "https://git.kernel.org/stable/c/a58a57a1076f8c5dae0327e3710899478c3be901",
        "https://git.kernel.org/stable/c/d848fac90c6f0566e7b93066b0b86024f65f395e",
        "https://git.kernel.org/stable/c/e82f260a74dea8cdd7857f2cc66f73d0da522bb3",
        "https://git.kernel.org/stable/c/f79f621215a0944c4a0e1b3b86b99e433ae8c527",
        "https://git.kernel.org/stable/c/fd93859ecfa5b6495a6863c18fd923a7666def26",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90341.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-90341",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90341.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-90341",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 513484,
  "published_at": "2026-09-17T16:08:52.307+00:00"
}