CVE-2026-53047

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> efi/capsule-loader: fix incorrect sizeof in phys array reallocation<br /> <br /> The krealloc() call for cap_info-&gt;phys in __efi_capsule_setup_info() uses<br /> sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be<br /> causing an undersized allocation.<br /> <br /> The allocation is also inconsistent with the initial array allocation in<br /> efi_capsule_open() that allocates one entry with sizeof(phys_addr_t),<br /> and the efi_capsule_write() function that stores phys_addr_t values (not<br /> pointers) via page_to_phys().<br /> <br /> On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this<br /> goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but<br /> pointers are 32-bit, this allocates half the required space, which might<br /> lead to a heap buffer overflow when storing physical addresses.<br /> <br /> This is similar to the bug fixed in commit fccfa646ef36 ("efi/capsule-loader:<br /> fix incorrect allocation size") which fixed the same issue at the initial<br /> allocation site.