CVE-2026-72013

Received Received - Intake

NULL Pointer Dereference in Linux Kernel riscv

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent NULL pointer dereference in machine_kexec_prepare() A NULL pointer dereference issue is noticed in riscv's machine_kexec_prepare(), where image->segment[i].buf might be NULL and copied unchecked. The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without a check in machine_kexec_prepare(): kexec_file_load -> kimage_file_alloc_init() -> kimage_file_prepare_segments() -> ima_add_kexec_buffer() -> kexec_add_buffer() -> machine_kexec_prepare() -> memcpy() Address this by adding a check before the data copy attempt.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72013

EUVD

EUVD-2026-59112

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's RISC-V architecture. It occurs in the machine_kexec_prepare() function where a NULL buffer (image->segment[i].buf) could be copied without validation, leading to a potential system crash or unexpected behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's riscv architecture and involves a NULL pointer dereference in machine_kexec_prepare(). Detection requires checking kernel logs for crashes or errors related to kexec operations, particularly during system reboot or kexec_file_load processes.

Impact Analysis

If exploited, this vulnerability could cause a kernel panic or system instability during kexec operations, which are used to reboot the system into a new kernel. This may result in denial of service or require a system restart to recover.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel NULL pointer dereference issue in the riscv architecture's machine_kexec_prepare() function, which could lead to system crashes or instability but does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Apply the latest kernel patch from your Linux distribution that resolves this issue. Avoid using kexec_file_load until the patch is applied. Monitor kernel logs for any signs of exploitation or crashes related to kexec operations.

Hi! I’m here to help you understand CVE-2026-72013. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70