CVE-2026-43240

Root

Cause

In the Linux kernel's x86 architecture, the kexec mechanism lacked a sanity check to verify that the IMA measurement list buffer from the previous kernel resides within the usable physical memory of the new kernel. When a second-stage kernel is booted via kexec with a restrictive command line parameter like mem=, the truncated RAM may exclude the physical range containing the measurement list. This missing bounds validation leads to a kernel panic (page fault) when the new kernel attempts to restore the measurement list via ima_restore_measurement_list [1][2][3][4].

Exploitation

An attacker must have the ability to trigger a kexec operation with a limiting mem= kernel command line parameter. This typically requires root or equivalent privileges on the system. The attack does not require any network access; it is a local vulnerability. The specific condition is that the carried-over IMA buffer resides in a physical memory region that falls outside the new kernel's truncated address space.

Impact

The immediate impact is a kernel panic, resulting in a denial of service (DoS) on the targeted system. Additionally, because the IMA measurement list is not carried over successfully, attestation mechanisms that rely on the continuity of measurement records across kexec may fail, undermining security guarantees for measured boot.

Mitigation

The vulnerability has been patched in the Linux kernel stable tree through commits [1], [2], [3], and [4] which add a page_is_ram() check on the IMA buffer's physical range, similar to the existing validation on other architectures (as done in commit cbf9c4b9617b). Users should update to a kernel version containing these fixes or apply the patches manually.