CVE-2026-43129 Overview
CVE-2026-43129 is a Linux kernel vulnerability in the Integrity Measurement Architecture (IMA) subsystem. The flaw triggers a page fault in ima_restore_measurement_list() during early boot of a kexec second-stage kernel. When the second-stage kernel boots with a memory-limiting command line such as mem=<size>, the IMA measurement buffer handed over from the previous kernel may fall outside addressable RAM. Accessing that buffer faults the kernel during early restore. The issue affects x86_64 systems; aarch64 was previously addressed in commit cbf9c4b9617b.
Critical Impact
A kexec boot with restricted memory parameters can dereference an unmapped physical range in the IMA buffer, producing an unhandled page fault during early kernel initialization.
Affected Products
- Linux kernel (x86_64) IMA subsystem on systems performing kexec with restricted memory
- Stable kernel branches receiving the fix in commits 10d1c75ed438, 5366ec7d2f79, 9e1f51c1ad57, and f11d7d088f5e
- OF (Open Firmware) based architectures sharing the same restore path
Discovery Timeline
- 2026-05-06 - CVE-2026-43129 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43129
Vulnerability Analysis
The Linux kernel's IMA subsystem preserves a measurement list across kexec by handing a physical buffer from the previous kernel to its successor. The successor kernel reads this buffer in ima_restore_measurement_list() during early initialization. The function did not verify that the handed-over physical range was mapped into the new kernel's addressable memory.
When an operator boots the second-stage kernel with mem=<size> or similar memory limits, the new kernel's reachable physical map can be smaller than the original. The IMA buffer pointer can then reference a physical frame that is not present in the new mapping. The first access faults with an error code of 0x0000 (not-present page) at the instruction reading the buffer, as shown in the reported BUG: unable to handle page fault for address: ffff97793ff47000 trace.
The fix introduces a generic helper, ima_validate_range(), which checks that the [start, end] physical range falls inside addressable RAM before access. On x86 the helper uses pfn_range_is_mapped(), and on OF-based architectures it uses page_is_ram(). The aarch64 path was already corrected via commit cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer against memory bounds").
Root Cause
The root cause is missing input validation on a physical address range inherited across kexec [CWE-20]. The previous-kernel IMA buffer was trusted to lie within the new kernel's addressable memory without verification, leading to a null/unmapped dereference [CWE-822] when memory limits shrank the mapping.
Attack Vector
Exploitation requires control over kernel boot parameters on the target system. An operator or process able to influence the kexec command line, specifically by adding mem=<size> to the second-stage kernel, can cause the page fault during IMA restore. The realistic outcome is a denial-of-service condition during early boot rather than memory disclosure or code execution. No remote attack vector applies.
No public proof-of-concept code is available. The vulnerability is described in upstream patch commits referenced in the kernel git tree.
Detection Methods for CVE-2026-43129
Indicators of Compromise
- Kernel oops or panic messages containing BUG: unable to handle page fault for address: immediately followed by RIP: ima_restore_measurement_list+.
- Boot failure of a kexec second-stage kernel when mem=<size> is present on the command line.
- Crash dumps showing #PF: error_code(0x0000) not-present page during early initialization on x86_64.
Detection Strategies
- Inventory running kernels and compare against the fixed commits 10d1c75ed438, 5366ec7d2f79, 9e1f51c1ad57, and f11d7d088f5e referenced in the kernel.org git tree.
- Audit kexec configurations and bootloader entries for memory-limiting parameters such as mem= on hosts that enable IMA measurement carry-over.
- Review system logs and kernel crash reports for repeated faults inside ima_restore_measurement_list after kexec transitions.
Monitoring Recommendations
- Forward kern.log, journalctl -k, and kdump artifacts to a central log store and alert on page-fault traces referencing IMA functions.
- Track changes to /etc/default/grub, /etc/kernel/cmdline, and kexec scripts that introduce or modify mem= parameters.
- Monitor kernel package versions across the fleet and flag hosts running pre-patch builds on architectures that use IMA over kexec.
How to Mitigate CVE-2026-43129
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 10d1c75ed438, 5366ec7d2f79, 9e1f51c1ad57, and f11d7d088f5e.
- Update to a stable kernel release that includes ima_validate_range() and the corresponding x86 and OF callers.
- On unpatched hosts, remove mem=<size> from kexec second-stage command lines until the kernel is updated.
Patch Information
The fix is distributed across four upstream commits in the Linux stable tree. The series introduces ima_validate_range() and routes x86 through pfn_range_is_mapped() and OF-based architectures through page_is_ram(). See the commits at 10d1c75ed438, 5366ec7d2f79, 9e1f51c1ad57, and f11d7d088f5e.
Workarounds
- Avoid passing mem=<size> or other memory-limiting parameters to second-stage kernels booted via kexec on x86_64.
- Disable IMA measurement carry-over across kexec where the policy permits, until the patched kernel is deployed.
- Use a fixed aarch64 kernel as a bridge for environments that must constrain memory at boot.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
