A critical out-of-bounds memory read vulnerability in the Linux kernel ARM hardware error handler could allow an attacker to trigger system instability or information disclosure.

The vulnerability exists within the ghes_handle_arm_hw_error function, where an incorrect size calculation (using pointer size instead of structure size) leads to an overestimation of available buffer space. This allows the parser to read past the intended CPER section when processing ARM hardware errors, which can be triggered locally without authentication.

The vulnerability carries a CVSS score of 8.4, reflecting its potential to cause significant system impact. Successful exploitation could lead to kernel memory corruption or information leakage, potentially resulting in system crashes or the unauthorized disclosure of sensitive data processed by the kernel.

Immediate Action: Update your Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later, as specified by the vendor's stable release cycle.

Proactive Monitoring: Monitor kernel logs for recurring hardware error events or unexpected system reboots that may indicate attempts to trigger the vulnerable error handling path.

Compensating Controls: Ensure that local access to the system is strictly limited to authorized personnel to prevent the execution of malicious code or the triggering of kernel-level vulnerabilities.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for kernel-level impact, this vulnerability should be prioritized for remediation in environments utilizing the affected kernel versions. Administrators should verify their current kernel build and apply the provided stable patches as soon as they are integrated into their distribution's update repositories to ensure system integrity.