CVE-2026-43240
Kernel Panic in Linux Kernel Due to IMA Kexec Buffer Overflow
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's x86 kexec functionality. When booting a second-stage kernel using kexec with a limited memory command line (e.g., "mem=<size>"), the physical memory range containing the carried-over IMA (Integrity Measurement Architecture) measurement list may lie outside the truncated RAM. This causes a kernel panic due to an invalid memory access (page fault).
The issue arises because the kernel does not properly check that the IMA kexec buffer from the previous kernel is within valid memory bounds before accessing it. Other architectures already perform this validation, but x86 did not until this fix was applied.
Without carrying the measurement list correctly across kexec, the attestation process would fail.
How can this vulnerability impact me? :
This vulnerability can cause the system to experience a kernel panic when booting a second-stage kernel via kexec with limited memory settings. This results in a denial of service as the kernel crashes due to an invalid memory access.
Additionally, if the IMA measurement list is not properly carried over, the system's attestation mechanisms may fail, potentially impacting system integrity verification.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a kernel panic when the second-stage kernel is booted via kexec with a limiting command line such as "mem=<size>" that causes the physical range containing the carried over IMA measurement list to fall outside the truncated RAM.
You may detect this issue by observing kernel panic logs with messages similar to:
- BUG: unable to handle page fault for address: ffff97793ff47000
- RIP: ima_restore_measurement_list+0xdc/0x45a
- #PF: error_code(0x0000) – not-present page
Since no specific detection commands are provided, monitoring kernel logs (e.g., using dmesg or journalctl) for these error messages after a kexec boot with memory limiting parameters is recommended.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by adding a sanity check on the previous kernel's IMA kexec buffer on x86 architectures, similar to checks already present on other architectures.
Immediate mitigation steps include:
- Avoid using limiting command lines such as "mem=<size>" during kexec that could truncate RAM and cause the IMA measurement list to fall outside the available memory.
- Apply the updated Linux kernel version that includes the fix for this vulnerability.
- Monitor for kernel panic messages related to this issue to detect if the vulnerability is being triggered.