CVE-2026-43240None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: x86/kexec: add a sanity check on previous kernel's ima kexec buffer When the second-stage kernel is booted via kexec with a limiting command line such as "mem=<size>",…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
x86/kexec: add a sanity check on previous kernel's ima kexec buffer
When the second-stage kernel is booted via kexec with a limiting command line such as "mem=<size>", the physical range that contains the carried over IMA measurement list may fall outside the truncated RAM leading to a kernel panic.
BUG: unable to handle page fault for address: ffff97793ff47000
RIP: ima_restore_measurement_list+0xdc/0x45a
#PF: error_code(0x0000) – not-present page
Other architectures already validate the range with page_is_ram(), as done in commit cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer against memory bounds") do a similar check on x86.
Without carrying the measurement list across kexec, the attestation would fail.
Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 < 37f18915a261afe84dab462624ed829cddb77a9bLinux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 < 22e460b6333a5f818b042ac89201f8e735556f4aLinux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 < 7e2476057950c174c7b2c2802246707bbfb497e4Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 < f8f73bf0f8a57ee9b86792456bd42079bc98c6b7Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 < d4a132f121c591b60dbaf57ea91f1faf11631fbcLinux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 < 4d7a8f5f28187e3d2958b2a134473da2665207e7Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 < c5489d04337b47e93c0623e8145fcba3f5739efdLinux 6.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses