CVE-2026-53047

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53047", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.381Z", "datePublished": "2026-06-24T16:29:53.491Z", "dateUpdated": "2026-11-06T16:23:56.769Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-24T16:29:53.491Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi/capsule-loader: fix incorrect sizeof in phys array reallocation\n\nThe krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses\nsizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be\ncausing an undersized allocation.\n\nThe allocation is also inconsistent with the initial array allocation in\nefi_capsule_open() that allocates one entry with sizeof(phys_addr_t),\nand the efi_capsule_write() function that stores phys_addr_t values (not\npointers) via page_to_phys().\n\nOn 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this\ngoes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but\npointers are 32-bit, this allocates half the required space, which might\nlead to a heap buffer overflow when storing physical addresses.\n\nThis is similar to the bug fixed in commit fccfa646ef36 (\"efi/capsule-loader:\nfix incorrect allocation size\") which fixed the same issue at the initial\nallocation site."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/efi/capsule-loader.c"], "versions": [{"version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "22022cd8851703a58f67615a17bc7e9e8682785b", "status": "affected", "versionType": "git"}, {"version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "67adde6bfdfd563a54b045d59aeb9a2d90c80697", "status": "affected", "versionType": "git"}, {"version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "608e1f7bc9d171ab26c1fba288c97fc76363c27d", "status": "affected", "versionType": "git"}, {"version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "8be69e9245f805566bac68ffc8574b64735fd996", "status": "affected", "versionType": "git"}, {"version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "5e185330d902b12fe8e6eb4b8514b5d736d8d66d", "status": "affected", "versionType": "git"}, {"version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "e0e6b14995fd6fa2c0df8c712d76ab32f0694c31", "status": "affected", "versionType": "git"}, {"version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "ab3f7098a3a27175b91cfc947950f5c26855801b", "status": "affected", "versionType": "git"}, {"version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "48a428215782321b56956974f23593e40ce84b7a", "status": "affected", "versionType": "git"}, {"version": "95a362c9a6892085f714eb6e31eea6a0e3aa93bf", "status": "affected", "versionType": "git"}, {"version": "4.14.13", "lessThan": "4.15", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/efi/capsule-loader.c"], "versions": [{"version": "4.15", "status": "affected"}, {"version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.6.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/22022cd8851703a58f67615a17bc7e9e8682785b"}, {"url": "https://git.kernel.org/stable/c/67adde6bfdfd563a54b045d59aeb9a2d90c80697"}, {"url": "https://git.kernel.org/stable/c/608e1f7bc9d171ab26c1fba288c97fc76363c27d"}, {"url": "https://git.kernel.org/stable/c/8be69e9245f805566bac68ffc8574b64735fd996"}, {"url": "https://git.kernel.org/stable/c/5e185330d902b12fe8e6eb4b8514b5d736d8d66d"}, {"url": "https://git.kernel.org/stable/c/e0e6b14995fd6fa2c0df8c712d76ab32f0694c31"}, {"url": "https://git.kernel.org/stable/c/ab3f7098a3a27175b91cfc947950f5c26855801b"}, {"url": "https://git.kernel.org/stable/c/48a428215782321b56956974f23593e40ce84b7a"}], "title": "efi/capsule-loader: fix incorrect sizeof in phys array reallocation", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53047", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:17:08.543367Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:23:56.769Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53047", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:17:08.543367Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:17:09.615Z"}}], "cna": {"title": "efi/capsule-loader: fix incorrect sizeof in phys array reallocation", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "22022cd8851703a58f67615a17bc7e9e8682785b", "versionType": "git"}, {"status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "67adde6bfdfd563a54b045d59aeb9a2d90c80697", "versionType": "git"}, {"status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "608e1f7bc9d171ab26c1fba288c97fc76363c27d", "versionType": "git"}, {"status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "8be69e9245f805566bac68ffc8574b64735fd996", "versionType": "git"}, {"status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "5e185330d902b12fe8e6eb4b8514b5d736d8d66d", "versionType": "git"}, {"status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "e0e6b14995fd6fa2c0df8c712d76ab32f0694c31", "versionType": "git"}, {"status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "ab3f7098a3a27175b91cfc947950f5c26855801b", "versionType": "git"}, {"status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "lessThan": "48a428215782321b56956974f23593e40ce84b7a", "versionType": "git"}, {"status": "affected", "version": "95a362c9a6892085f714eb6e31eea6a0e3aa93bf", "versionType": "git"}, {"status": "affected", "version": "4.14.13", "lessThan": "4.15", "versionType": "semver"}], "programFiles": ["drivers/firmware/efi/capsule-loader.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"status": "unaffected", "version": "0", "lessThan": "4.15", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.141", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.91", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.33", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.10", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/firmware/efi/capsule-loader.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/22022cd8851703a58f67615a17bc7e9e8682785b"}, {"url": "https://git.kernel.org/stable/c/67adde6bfdfd563a54b045d59aeb9a2d90c80697"}, {"url": "https://git.kernel.org/stable/c/608e1f7bc9d171ab26c1fba288c97fc76363c27d"}, {"url": "https://git.kernel.org/stable/c/8be69e9245f805566bac68ffc8574b64735fd996"}, {"url": "https://git.kernel.org/stable/c/5e185330d902b12fe8e6eb4b8514b5d736d8d66d"}, {"url": "https://git.kernel.org/stable/c/e0e6b14995fd6fa2c0df8c712d76ab32f0694c31"}, {"url": "https://git.kernel.org/stable/c/ab3f7098a3a27175b91cfc947950f5c26855801b"}, {"url": "https://git.kernel.org/stable/c/48a428215782321b56956974f23593e40ce84b7a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi/capsule-loader: fix incorrect sizeof in phys array reallocation\n\nThe krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses\nsizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be\ncausing an undersized allocation.\n\nThe allocation is also inconsistent with the initial array allocation in\nefi_capsule_open() that allocates one entry with sizeof(phys_addr_t),\nand the efi_capsule_write() function that stores phys_addr_t values (not\npointers) via page_to_phys().\n\nOn 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this\ngoes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but\npointers are 32-bit, this allocates half the required space, which might\nlead to a heap buffer overflow when storing physical addresses.\n\nThis is similar to the bug fixed in commit fccfa646ef36 (\"efi/capsule-loader:\nfix incorrect allocation size\") which fixed the same issue at the initial\nallocation site."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.258", "versionStartIncluding": "4.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.209", "versionStartIncluding": "4.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "4.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.141", "versionStartIncluding": "4.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.91", "versionStartIncluding": "4.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.33", "versionStartIncluding": "4.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.10", "versionStartIncluding": "4.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "4.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.14.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-24T16:29:53.491Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53047", "state": "PUBLISHED", "dateUpdated": "2026-11-06T16:23:56.769Z", "dateReserved": "2026-06-09T07:44:35.381Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-06-24T16:29:53.491Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/firmware/efi/capsule-loader.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "22022cd8851703a58f67615a17bc7e9e8682785b", "status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "versionType": "git"}, {"lessThan": "67adde6bfdfd563a54b045d59aeb9a2d90c80697", "status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "versionType": "git"}, {"lessThan": "608e1f7bc9d171ab26c1fba288c97fc76363c27d", "status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "versionType": "git"}, {"lessThan": "8be69e9245f805566bac68ffc8574b64735fd996", "status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "versionType": "git"}, {"lessThan": "5e185330d902b12fe8e6eb4b8514b5d736d8d66d", "status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "versionType": "git"}, {"lessThan": "e0e6b14995fd6fa2c0df8c712d76ab32f0694c31", "status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "versionType": "git"}, {"lessThan": "ab3f7098a3a27175b91cfc947950f5c26855801b", "status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "versionType": "git"}, {"lessThan": "48a428215782321b56956974f23593e40ce84b7a", "status": "affected", "version": "f24c4d478013d82bd1b943df566fff3561d52864", "versionType": "git"}, {"status": "affected", "version": "95a362c9a6892085f714eb6e31eea6a0e3aa93bf", "versionType": "git"}, {"lessThan": "4.15", "status": "affected", "version": "4.14.13", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/firmware/efi/capsule-loader.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"lessThan": "4.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.141", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.91", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.33", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4B245EE2-CC73-420B-B573-93C5323D9433", "versionEndExcluding": "4.15", "versionStartIncluding": "4.14.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "025D79B4-921A-41A7-A695-91D339C3ABF1", "versionEndExcluding": "5.10.258", "versionStartIncluding": "4.15.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "97A9FFFA-22BB-4D5C-9790-5A2286E392F7", "versionEndExcluding": "6.6.141", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C918746B-DE6F-448F-A93E-A04C5481688D", "versionEndExcluding": "6.12.91", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D99E49-380D-43AB-BDBA-25C3AD018A9C", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.15:-:*:*:*:*:*:*", "matchCriteriaId": "3B4D39AF-668B-442B-8085-639A6D4FA5AC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.15:rc7:*:*:*:*:*:*", "matchCriteriaId": "A282AD0B-2D63-4F05-8F89-109A0975B423", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.15:rc8:*:*:*:*:*:*", "matchCriteriaId": "30358221-183C-4699-994E-AF51F5D534FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.15:rc9:*:*:*:*:*:*", "matchCriteriaId": "A5ED80A8-E656-4AE9-921B-C22402C94A4C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi/capsule-loader: fix incorrect sizeof in phys array reallocation\n\nThe krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses\nsizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be\ncausing an undersized allocation.\n\nThe allocation is also inconsistent with the initial array allocation in\nefi_capsule_open() that allocates one entry with sizeof(phys_addr_t),\nand the efi_capsule_write() function that stores phys_addr_t values (not\npointers) via page_to_phys().\n\nOn 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this\ngoes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but\npointers are 32-bit, this allocates half the required space, which might\nlead to a heap buffer overflow when storing physical addresses.\n\nThis is similar to the bug fixed in commit fccfa646ef36 (\"efi/capsule-loader:\nfix incorrect allocation size\") which fixed the same issue at the initial\nallocation site."}], "id": "CVE-2026-53047", "lastModified": "2026-11-06T17:18:02.890", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53047", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T16:17:08.543367Z", "version": "2.0.3"}}]}, "published": "2026-06-24T17:17:16.533", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/22022cd8851703a58f67615a17bc7e9e8682785b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/48a428215782321b56956974f23593e40ce84b7a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5e185330d902b12fe8e6eb4b8514b5d736d8d66d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/608e1f7bc9d171ab26c1fba288c97fc76363c27d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/67adde6bfdfd563a54b045d59aeb9a2d90c80697"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8be69e9245f805566bac68ffc8574b64735fd996"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ab3f7098a3a27175b91cfc947950f5c26855801b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e0e6b14995fd6fa2c0df8c712d76ab32f0694c31"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: efi/capsule-loader: fix incorrect sizeof in phys array reallocation", "id": "2492279", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492279"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-131", "details": ["A flaw was found in the Linux kernel's EFI (Extensible Firmware Interface) capsule loader. An incorrect size calculation during memory reallocation for physical addresses can lead to an undersized buffer. This issue, specifically on 32-bit systems with Physical Address Extension (PAE), may result in a heap buffer overflow when storing physical addresses. This could potentially allow a local attacker to cause a denial of service or achieve arbitrary code execution."], "name": "CVE-2026-53047", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53047\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53047\nhttps://lore.kernel.org/linux-cve-announce/2026062458-CVE-2026-53047-7dc7@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f24c4d478013d82bd1b943df566fff3561d52864,22022cd8851703a58f67615a17bc7e9e8682785b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f24c4d478013d82bd1b943df566fff3561d52864,67adde6bfdfd563a54b045d59aeb9a2d90c80697)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f24c4d478013d82bd1b943df566fff3561d52864,608e1f7bc9d171ab26c1fba288c97fc76363c27d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f24c4d478013d82bd1b943df566fff3561d52864,8be69e9245f805566bac68ffc8574b64735fd996)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f24c4d478013d82bd1b943df566fff3561d52864,5e185330d902b12fe8e6eb4b8514b5d736d8d66d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f24c4d478013d82bd1b943df566fff3561d52864,e0e6b14995fd6fa2c0df8c712d76ab32f0694c31)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f24c4d478013d82bd1b943df566fff3561d52864,ab3f7098a3a27175b91cfc947950f5c26855801b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f24c4d478013d82bd1b943df566fff3561d52864,48a428215782321b56956974f23593e40ce84b7a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "95a362c9a6892085f714eb6e31eea6a0e3aa93bf"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.14.13,4.15)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.258,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.209,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.175,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.141,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.91,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.33,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0.10,7.0.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T21:00:11.771964+00:00", "updated": "2026-08-12T07:15:02.526659+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}