← Back

CVE-2026-43289

nvd nist
Published: May 8, 2026Modified: May 15, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 1.8 / Impact: 3.6
Source: NVD

Description

In the Linux kernel, the following vulnerability has been resolved: kexec: derive purgatory entry from symbol kexec_load_purgatory() derives image->start by locating e_entry inside an SHF_EXECINSTR section. If the purgatory object contains multiple executable sections with overlapping sh_addr, the entrypoint check can match more than once and trigger a WARN. Derive the entry section from the purgatory_start symbol when present and compute image->start from its final placement. Keep the existing e_entry fallback for purgatories that do not expose the symbol. WARNING: kernel/kexec_file.c:1009 at kexec_load_purgatory+0x395/0x3c0, CPU#10: kexec/1784 Call Trace: <TASK> bzImage64_load+0x133/0xa00 __do_sys_kexec_file_load+0x2b3/0x5c0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e [me@linux.beauty: move helper to avoid forward declaration, per Baoquan]

Affected (19)

Products: Linux: Linux Kernel
1 product
Linux Kernel
Configuration A
19 vulnerable
Vulnerable SoftwareAffected Versions
Linux
From 4.19.287 to 4.20
From 5.10.185 to 5.10.252
From 5.15.118 to 5.15.202
From 5.4.248 to 5.5
From 6.1.35 to 6.1.165
From 6.13 to 6.18.16
From 6.19 to 6.19.6
From 6.3.9 to 6.4
From 6.4.1 to 6.6.128
From 6.7 to 6.12.75
Version 6.4
Version 6.4 rc7
Version 7.0 rc1
Version 7.0 rc2
Version 7.0 rc3
Version 7.0 rc4
Version 7.0 rc5
Version 7.0 rc6
Version 7.0 rc7

References (8)

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Patch

Timeline

No history available yet.