CVE-2026-90341
firmware: coreboot: Validate table bounds
Description
In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table. A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header. Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table.
INFO
Published Date :
Sept. 17, 2026, 5:17 p.m.
Last Modified :
Sept. 18, 2026, 6:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Reject resources shorter than the fixed header.
- Validate signature and require complete header.
- Check for overflow and reject extents beyond resource.
- Remap table after validation.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-90341.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-90341 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-90341
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-90341 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-90341 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 18, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 17, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table. A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header. Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90341.json">CVE-2026-90341</a> Added Reference https://git.kernel.org/stable/c/2d98a3b89394f283f054a4a54587c14ee89acaf9 Added Reference https://git.kernel.org/stable/c/3cca0d6dd4c2636d2514234233cb02db76621607 Added Reference https://git.kernel.org/stable/c/88027241c1d2c3213bac937a1c2cb89a5775a413 Added Reference https://git.kernel.org/stable/c/a58a57a1076f8c5dae0327e3710899478c3be901 Added Reference https://git.kernel.org/stable/c/d848fac90c6f0566e7b93066b0b86024f65f395e Added Reference https://git.kernel.org/stable/c/e82f260a74dea8cdd7857f2cc66f73d0da522bb3 Added Reference https://git.kernel.org/stable/c/f79f621215a0944c4a0e1b3b86b99e433ae8c527 Added Reference https://git.kernel.org/stable/c/fd93859ecfa5b6495a6863c18fd923a7666def26