Executive brief
A vulnerability in the Linux kernel's Integrity Measurement Architecture (IMA) can cause a system crash during the boot process. When a system restarts using a specific fast-reboot method (kexec) with certain memory limitations, the kernel may attempt to access memory that is no longer available. This results in a 'page fault' or kernel panic, leading to a denial of service where the system fails to start properly.
Technical details
A vulnerability exists in the Linux kernel's IMA (Integrity Measurement Architecture) during kexec-based soft reboots on x86_64 architectures. When the second-stage kernel is booted with memory-limiting command-line arguments (e.g., 'mem=<size>'), the IMA measurement buffer inherited from the previous kernel may fall outside the new kernel's addressable RAM range. This results in a kernel page fault in 'ima_restore_measurement_list()' during early restore. The fix introduces 'ima_validate_range()' to ensure the buffer lies within mapped PFNs (on x86) or valid RAM (on OF-based architectures) before access. Patches are available in various stable kernel branches including 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 6.0 to 6.12.77, 6.18.16, 6.19.6
Timeline
- 2025-12-30: other: Initial patch authored
- 2026-05-06: disclosed: CVE published
- 2026-01-26: patched: Mainline patch committed
References
- https://git.kernel.org/stable/c/10d1c75ed4382a8e79874379caa2ead8952734f9
- https://git.kernel.org/stable/c/43308106a1762b72f3b20a44b75b2df5cb25b77b
- https://git.kernel.org/stable/c/5366ec7d2f793ce703c403d7fd4c25a3db365b9d
- https://git.kernel.org/stable/c/9e1f51c1ad57cc76a0e8b5eb27038f8973fff4fa
- https://git.kernel.org/stable/c/f11d7d088f5ed54b31c6735854c12845eb60eb4a