The Linux kernel’s APEI/GHES logic prevents allocating overly large records by testing against a fixed maximum of 64 KB, but the actual allocation size is derived from the number of pages reported by the CPER BIOS table, which can be smaller. A firmware that supplies CPER data with a larger size than the allocated buffer can trigger a buffer overrun during a later dump operation, causing a kernel OOPS and a system crash. The bug is a classic buffer overflow that only affects kernel stability and does not grant code execution or privilege escalation.

Any Linux kernel that contains the unpatched ghes_new/ghes handling code is affected. The issue was observed in kernel 6.19.0‑rc1, but every release prior to the commit that fixed the CPER size check is vulnerable. Distributions that ship the upstream kernel without the patch are at risk unless they have applied a vendor backport.

The flaw can be triggered by firmware supplied during boot or via ACPI Hedge Event Device notifications. Successful exploitation requires a malicious or buggy firmware that can inject an oversized CPER record, making the attack vector local to the firmware environment rather than network‑based. The EPSS score is < 1%, and the CVSS score is 5.5, indicating a medium severity. The vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the potential to crash the kernel makes it a high‑severity availability issue. No evidence of arbitrary code execution is provided, so the primary risk is denial of service rather than privilege escalation.