VulnerabilityPublished 6 May 2026Updated 6 Nov 2026

CVE-2026-43240: Linux kernel · x86/kexec: add a sanity check on previous kernel's ima kexec buffer

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f8f73bf0f8a57ee9b86792456bd42079bc98c6b7 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 15:50 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in f8f73bf0f8a57ee9b86792456bd42079bc98c6b7, d4a132f121c591b60dbaf57ea91f1faf11631fbc, c5489d04337b47e93c0623e8145fcba3f5739efd +4

Exploitation evidence

Disclosed: evidence found.
CVE published 6 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ b69a2afd5afce9bf6d56e349d6ab592c916e20f2, < f8f73bf0f8a57ee9b86792456bd42079bc98c6b7	Fixed in f8f73bf0f8a57ee9b86792456bd42079bc98c6b7
LinuxLinux	Affected ≥ b69a2afd5afce9bf6d56e349d6ab592c916e20f2, < d4a132f121c591b60dbaf57ea91f1faf11631fbc	Fixed in d4a132f121c591b60dbaf57ea91f1faf11631fbc
LinuxLinux	Affected ≥ b69a2afd5afce9bf6d56e349d6ab592c916e20f2, < c5489d04337b47e93c0623e8145fcba3f5739efd	Fixed in c5489d04337b47e93c0623e8145fcba3f5739efd
LinuxLinux	Affected ≥ b69a2afd5afce9bf6d56e349d6ab592c916e20f2, < 37f18915a261afe84dab462624ed829cddb77a9b	Fixed in 37f18915a261afe84dab462624ed829cddb77a9b
LinuxLinux	Affected ≥ b69a2afd5afce9bf6d56e349d6ab592c916e20f2, < 22e460b6333a5f818b042ac89201f8e735556f4a	Fixed in 22e460b6333a5f818b042ac89201f8e735556f4a
LinuxLinux	Affected ≥ b69a2afd5afce9bf6d56e349d6ab592c916e20f2, < 7e2476057950c174c7b2c2802246707bbfb497e4	Fixed in 7e2476057950c174c7b2c2802246707bbfb497e4

AI-suggested

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to a kernel version that includes the fix identified by the commits listed in the established facts. No additional mitigation is required once the patch is applied.

Description

A vulnerability in the Linux kernel's x86 kexec implementation could cause a kernel panic when booting a second-stage kernel with a limited memory command line, due to improper validation of the IMA measurement list buffer. This issue has been fixed by adding a sanity check on the previous kernel's IMA kexec buffer to ensure it falls within valid memory bounds.

Impact

If exploited, this vulnerability can cause a kernel panic during kexec boot, leading to denial of service. Additionally, failure to carry the IMA measurement list across kexec boots can cause attestation failures, potentially impacting system integrity verification processes.

Summary

CVE-2026-43240 addresses a flaw in the Linux kernel's x86 kexec code where the physical memory range containing the carried-over IMA measurement list from the previous kernel is not properly validated against the truncated RAM size specified by a limiting command line such as "mem=<size>". This can lead to the kernel attempting to access memory outside the available RAM, causing a kernel panic with a page fault error. Other architectures already perform this validation using page_is_ram(). The fix adds a similar sanity check on x86 to prevent the kernel panic and ensure the IMA measurement list is correctly carried across kexec boots, preserving attestation integrity.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 15:50 UTC

Technical details

References

Community reviews

Related threats