The Linux kernel’s GHES handler for ACPI on ARM architectures miscalculates the remaining length of a CPER section after skipping its header. It subtracts the size of a pointer instead of the size of the pointed‑to structure, therefore overestimating the bytes left for subsequent error records. If the declared number of records exceeds the actual data length, the parser reads past the end of the CPER section, causing an out‑of‑bounds read. The description does not assert broader memory corruption or code execution, but a malformed CPER section may trigger a kernel panic or corruption of kernel data structures.

All Linux kernel builds that implement the ACPI APEI/GHES error reporting on ARM hardware are affected. The flaw exists in any kernel version that includes the GHES handler before the patch; specific version information is not listed.

The EPSS score is less than 1 % and the vulnerability is not in the CISA KEV catalog, suggesting low exploitation probability. The CVSS score of 5.1 indicates a moderate severity. The primary attack vector requires injection of a malformed CPER section, which typically requires local or firmware‑level access. Until the kernel patch that corrects the length accounting is applied, affected systems remain vulnerable to an out‑of‑bounds read that could destabilize the kernel.