CVE-2026-43240: x86/kexec: add a sanity check on previous kernel's ima kexec buffer
In the Linux kernel, the following vulnerability has been resolved:
x86/kexec: add a sanity check on previous kernel's ima kexec buffer
When the second-stage kernel is booted via kexec with a limiting command line such as "mem=<size>", the physical range that contains the carried over IMA measurement list may fall outside the truncated RAM leading to a kernel panic.
BUG: unable to handle page fault for address: ffff97793ff47000 RIP: imarestoremeasurementlist+0xdc/0x45a #PF: errorcode(0x0000) – not-present page
Other architectures already validate the range with pageisram(), as done in commit cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer against memory bounds") do a similar check on x86.
Without carrying the measurement list across kexec, the attestation would fail.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch cbf9c4b9617b
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43240?
CVE-2026-43240 has been classified with a severity level that indicates a potential risk to system integrity during kernel boot operations.
How do I fix CVE-2026-43240?
To resolve CVE-2026-43240, update to the latest stable version of the Linux kernel that includes the patch for this vulnerability.
What systems are affected by CVE-2026-43240?
CVE-2026-43240 affects x86 architectures running vulnerable versions of the Linux kernel utilizing the kexec feature.
What does CVE-2026-43240 involve?
CVE-2026-43240 involves a lack of sanity checks on the previous kernel's ima kexec buffer, potentially leading to security issues.
Is there a workaround for CVE-2026-43240?
A temporary workaround for CVE-2026-43240 may involve avoiding the use of kexec until a patch can be applied.