---
id: CVE-2026-43240
title: 'x86/kexec: add a sanity check on previous kernel''s ima kexec buffer'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  x86/kexec: add a sanity check on previous kernel's ima kexec buffer

  When the second-stage kernel is booted via kexec with a limiting command
  line such as "mem=<size>",…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 <
    37f18915a261afe84dab462624ed829cddb77a9b
  - >-
    Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 <
    22e460b6333a5f818b042ac89201f8e735556f4a
  - >-
    Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 <
    7e2476057950c174c7b2c2802246707bbfb497e4
  - >-
    Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 <
    f8f73bf0f8a57ee9b86792456bd42079bc98c6b7
  - >-
    Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 <
    d4a132f121c591b60dbaf57ea91f1faf11631fbc
  - >-
    Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 <
    4d7a8f5f28187e3d2958b2a134473da2665207e7
  - >-
    Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 <
    c5489d04337b47e93c0623e8145fcba3f5739efd
  - Linux 6.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:31:10.692661Z'
published: '2026-05-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:37.007Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43240'
references:
  - url: 'https://git.kernel.org/stable/c/37f18915a261afe84dab462624ed829cddb77a9b'
  - url: 'https://git.kernel.org/stable/c/22e460b6333a5f818b042ac89201f8e735556f4a'
  - url: 'https://git.kernel.org/stable/c/7e2476057950c174c7b2c2802246707bbfb497e4'
  - url: 'https://git.kernel.org/stable/c/f8f73bf0f8a57ee9b86792456bd42079bc98c6b7'
  - url: 'https://git.kernel.org/stable/c/d4a132f121c591b60dbaf57ea91f1faf11631fbc'
  - url: 'https://git.kernel.org/stable/c/4d7a8f5f28187e3d2958b2a134473da2665207e7'
  - url: 'https://git.kernel.org/stable/c/c5489d04337b47e93c0623e8145fcba3f5739efd'
tags:
  - cve.org
epss: 0.00123
epssPercentile: 0.02052
ingestedAt: '2026-11-06T15:54:04.005Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

x86/kexec: add a sanity check on previous kernel's ima kexec buffer

When the second-stage kernel is booted via kexec with a limiting command
line such as "mem=<size>", the physical range that contains the carried
over IMA measurement list may fall outside the truncated RAM leading to a
kernel panic.

    BUG: unable to handle page fault for address: ffff97793ff47000
    RIP: ima_restore_measurement_list+0xdc/0x45a
    #PF: error_code(0x0000) – not-present page

Other architectures already validate the range with page_is_ram(), as done
in commit cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer
against memory bounds") do a similar check on x86.

Without carrying the measurement list across kexec, the attestation
would fail.

## Affected

- `Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 < 37f18915a261afe84dab462624ed829cddb77a9b`
- `Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 < 22e460b6333a5f818b042ac89201f8e735556f4a`
- `Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 < 7e2476057950c174c7b2c2802246707bbfb497e4`
- `Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 < f8f73bf0f8a57ee9b86792456bd42079bc98c6b7`
- `Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 < d4a132f121c591b60dbaf57ea91f1faf11631fbc`
- `Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 < 4d7a8f5f28187e3d2958b2a134473da2665207e7`
- `Linux >= b69a2afd5afce9bf6d56e349d6ab592c916e20f2 < c5489d04337b47e93c0623e8145fcba3f5739efd`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.