{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.85-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.19.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  APEI/GHES: ARM processor Error: don't go past allocated memory  If the BIOS generates a very small ARM Processor Error, or an incomplete one, the current logic will fail to deferrence  \terr-\u003esection_length and \tctx_info-\u003esize  Add checks to avoid that. With such changes, such GHESv2 records won't cause OOPSes like this:  [    1.492129] Internal error: Oops: 0000000096000005 [#1]  SMP [    1.495449] Modules linked in: [    1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT [    1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 [    1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred [    1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [    1.497199] pc : log_arm_hw_error+0x5c/0x200 [    1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220  0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75). 70\t\terr_info = (struct cper_arm_err_info *)(err + 1); 71\t\tctx_info = (struct cper_arm_ctx_info *)(err_info + err-\u003eerr_info_num); 72\t\tctx_err = (u8 *)ctx_info; 73 74\t\tfor (n = 0; n \u003c err-\u003econtext_info_num; n++) { 75\t\t\tsz = sizeof(struct cper_arm_ctx_info) + ctx_info-\u003esize; 76\t\t\tctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); 77\t\t\tctx_len += sz; 78\t\t} 79  and similar ones while trying to access section_length on an error dump with too small size.  [ rjw: Subject tweaks ]",
  "id": "DEBIAN-CVE-2026-43201",
  "modified": "2026-09-14T16:47:35.169343024Z",
  "published": "2026-05-06T12:16:39.223Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-43201"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-43201"
  ]
}