Executive brief
A vulnerability in the Linux kernel's x86 architecture could cause a system crash (kernel panic) during a specific type of reboot known as kexec. This occurs when the system attempts to carry over security measurement logs to a new kernel while memory limits are restricted via command-line arguments. An exploit results in a complete loss of system availability, requiring a hard reboot to recover.
Technical details
A flaw in the x86 kexec implementation fails to validate the memory range of the Integrity Measurement Architecture (IMA) measurement list carried over from a previous kernel. When a second-stage kernel is booted with memory-limiting parameters (e.g., 'mem=size'), the physical address of the IMA buffer may reside in a region no longer recognized as RAM. This leads to a page fault and subsequent kernel panic in 'ima_restore_measurement_list' due to an attempt to access a non-present page. The fix introduces a sanity check using 'ima_validate_range' to ensure the buffer is within valid memory bounds before access.
Affected products
- Linux Linux Kernel 6.0 to 7.0 (exclusive)
Timeline
- 2025-12-30: patched: Initial patch authored
- 2026-05-06: disclosed: CVE published
References
- https://git.kernel.org/stable/c/22e460b6333a5f818b042ac89201f8e735556f4a
- https://git.kernel.org/stable/c/37f18915a261afe84dab462624ed829cddb77a9b
- https://git.kernel.org/stable/c/4d7a8f5f28187e3d2958b2a134473da2665207e7
- https://git.kernel.org/stable/c/7e2476057950c174c7b2c2802246707bbfb497e4
- https://git.kernel.org/stable/c/c5489d04337b47e93c0623e8145fcba3f5739efd
- https://git.kernel.org/stable/c/d4a132f121c591b60dbaf57ea91f1faf11631fbc
- https://git.kernel.org/stable/c/f8f73bf0f8a57ee9b86792456bd42079bc98c6b7