CVE-2026-43129

Vulnerability

CVE-2026-43129 is a vulnerability in the Linux kernel's Integrity Measurement Architecture (IMA) subsystem. When a second-stage kernel is booted via kexec with a limiting command line (e.g., mem=), the IMA measurement buffer handed over from the previous kernel may reside outside the new kernel's addressable RAM. Accessing such a buffer during early restore triggers a page fault, as observed in the bug report.

Exploitation

An attacker with the ability to control the kexec boot command line (e.g., by adjusting mem=) could potentially trigger this page fault. The vulnerability is exploitable only on x86_64 systems; it was already fixed on aarch64 by commit cbf9c4b9617b [1]. Exploitation requires physical access or privileged control over the kernel boot parameters, and the system must be configured for kexec.

Impact

Successful exploitation results in a kernel page fault, likely causing a system crash (denial of service). The crash occurs during early boot of the second kernel, preventing the system from starting. No privilege escalation or data integrity impact is described.

Mitigation

The fix introduces a generic helper, ima_validate_range(), which verifies that the physical address range of the previous-kernel IMA buffer lies within addressable memory. On x86, it uses pfn_range_is_mapped(); on OF-based architectures, it uses page_is_ram() [2][3][4]. The patch series has been applied to the Linux kernel stable branches. Users should update to a patched kernel version.