Executive brief
A vulnerability was identified in the Linux kernel's handling of digitally signed executable files. By providing a specially crafted file, an attacker could cause the system to crash or potentially read sensitive information from the computer's memory. This affects the core security mechanism used to verify the integrity of software before it is executed, which could lead to a complete system failure (kernel panic).
Technical details
An out-of-bounds (OOB) read vulnerability exists in the pefile_digest_pe_contents() function within the Linux kernel's crypto/asymmetric_keys/verify_pefile.c component. The issue stems from an integer underflow when calculating the trailing-data hash length: pelen - (hashed_bytes + certs_size). A crafted PE file can cause the addition to exceed the total length (pelen), resulting in a large underflow value (~4 GiB) being passed to crypto_shash_update(). This causes the kernel to read beyond allocated memory boundaries, typically resulting in a kernel panic when hitting unmapped vmalloc guard pages. The vulnerability is reachable via system calls like kexec_file_load that perform PE signature verification. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel af316fc442ef to 89efd998470a93284b7ad5a20d4e0e3c6858ae8e
Timeline
- 2026-07-27: advisory: NVD publication date
- 2026-07-24: patched: Commits applied to stable trees
References
- https://git.kernel.org/stable/c/627938383761fb4334b41ebe7ef438d6b8b19d60
- https://git.kernel.org/stable/c/6acd2fbd00f9c72aebefce63fc2e73e8f3d79061
- https://git.kernel.org/stable/c/7016377699b5b25b7ec3c0bf2ec3f983c7e95f7c
- https://git.kernel.org/stable/c/803591785d33cf13b6f73ce2796e8b9e6d5e6526
- https://git.kernel.org/stable/c/89efd998470a93284b7ad5a20d4e0e3c6858ae8e
- https://git.kernel.org/stable/c/b798ada5a5d1cb4cc4cfa72074b1b463eca6c506
- https://git.kernel.org/stable/c/e162bc386e71b5412425a38ee048e8d2185491b9