CVE-2026-82017: Insufficient Verification of Data Authenticity in IGEL IGEL OS 12

CVE-2026-82017 is a boot registry parameter injection vulnerability in IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150. The vulnerability arises because the bootloader reads configuration parameters from an unencrypted and unsigned area, allowing an attacker with physical access to write arbitrary Linux loader parameters. These injected parameters execute with boot environment privileges and do not cause TPM PCR measurement failures, as the attack does not alter the measured boot code. This enables privilege escalation at boot time without detection by TPM-based integrity checks.

An attacker with physical access can execute arbitrary kernel command line parameters during boot, gaining elevated privileges in the boot environment. This can lead to unauthorized code execution with high privileges, bypassing TPM-based boot integrity verification. The vulnerability does not require user interaction or prior privileges and can compromise system integrity at a fundamental level.

A fix is available in IGEL OS versions 12.7.6 and later, and 11.11.150 and later. Users should upgrade to these versions to remediate the vulnerability. Since the vulnerability requires physical access, restricting physical access to devices is also recommended as a preventive measure.