Executive brief
A vulnerability in the Linux kernel's x86 kexec component could cause the system to crash during a reboot or kernel handover process. The issue occurs when the system attempts to transition to a new kernel and the 'purgatory' code tries to access a memory address that is no longer present on the stack. This results in a kernel fault, potentially leading to a denial of service during critical system transitions.
Technical details
A vulnerability exists in the x86/kexec component of the Linux kernel due to a regression in how the stack is handled during kernel relocation. The purgatory code in kexec-tools unconditionally attempts to read a return address from the top of the stack to determine if it is performing a 'kjump' (context preservation). A previous commit removed the 'gratuitous' pushing of this return address for non-kjump paths, causing the purgatory code to read out-of-bounds or access unmapped memory, resulting in a fault. This affects x86_64 systems using kexec-tools. The fix restores the practice of pushing a dummy value (0) onto the stack in the non-kjump path to satisfy the purgatory code's expectations.
Affected products
- Linux Linux Kernel 6.14 to 7.1
Timeline
- 2026-04-28: other: Patch authored
- 2026-06-26: disclosed: CVE published