The vulnerability in the Linux kernel's efi/capsule-loader component involved an incorrect use of sizeof in the krealloc() call for cap_info->phys within __efi_capsule_setup_info(). Specifically, sizeof(phys_addr_t *) was used instead of sizeof(phys_addr_t), resulting in an undersized allocation. On 64-bit systems, this went unnoticed because pointers and phys_addr_t have the same size, but on 32-bit systems with PAE where phys_addr_t is 64-bit and pointers are 32-bit, the allocation was only half the required size. This could lead to a heap buffer overflow when storing physical addresses. The issue is similar to a previously fixed bug in the same component, which corrected the allocation size at the initial allocation site.

On affected 32-bit systems with PAE, the undersized allocation may cause a heap buffer overflow when physical addresses are stored, potentially leading to system instability or denial of service. There is no indication of confidentiality or integrity impact. The CVSS score is 5.5 (medium severity) with an impact on availability only.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include the corrected allocation size in the efi/capsule-loader component. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.