CVE-2026-43240: Linux Kernel IMA Kexec Buffer DoS Flaw

CVE-2026-43240 Overview

CVE-2026-43240 affects the Linux kernel's x86/kexec subsystem. The flaw stems from a missing sanity check on the previous kernel's Integrity Measurement Architecture (IMA) kexec buffer. When the second-stage kernel boots through kexec with a memory-limiting command line such as mem=<size>, the physical range holding the carried-over IMA measurement list can fall outside the truncated RAM. The kernel then dereferences a non-present page during ima_restore_measurement_list, producing a page fault and kernel panic. Without carrying the measurement list across kexec, remote attestation also fails, breaking integrity verification workflows on affected x86 systems.

Critical Impact
A kernel panic during early boot of a kexec-launched kernel disrupts availability of x86 systems relying on IMA measurement continuity for attestation.

Affected Products

Linux kernel (x86 architecture, arch/x86 kexec code path)
Distributions shipping kernels prior to the upstream fix commits referenced below
Systems using IMA measurement list carryover across kexec transitions

Discovery Timeline

2026-05-06 - CVE-2026-43240 published to the National Vulnerability Database
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43240

Vulnerability Analysis

The Linux kernel supports carrying an IMA measurement list across a kexec boot so the new kernel preserves the chain of measurements required for remote attestation. On x86, the kexec code accepted the previous kernel's IMA buffer descriptor without validating that the referenced physical range still resides within usable RAM. When an operator boots the second-stage kernel with a restrictive mem=<size> parameter, the buffer's original physical address can now point past the truncated memory boundary.

During ima_restore_measurement_list, the kernel attempts to read measurement entries from this stale physical address. The access targets a non-present page, raising a page fault that the early boot path cannot recover from. The reported trace shows BUG: unable to handle page fault for address: ffff97793ff47000 followed by a fault at ima_restore_measurement_list+0xdc/0x45a with error_code(0x0000) – not-present page.

Other architectures already guard the same operation. Commit cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer against memory bounds") added a page_is_ram() validation for OpenFirmware-based platforms. The x86 path lacked an equivalent check until the fixes referenced in this CVE.

Root Cause

The root cause is missing input validation on a memory descriptor inherited from the previous kernel. The x86 kexec handler trusted the IMA buffer's physical range without confirming it intersected the live memory map. When mem= truncates RAM, the trust assumption breaks and the dereference targets unmapped memory, classifying this as a kernel-level [CWE-125] out-of-bounds read on x86.

Attack Vector

Triggering the panic requires local privilege to invoke kexec with a memory-limiting command line on a system where IMA carryover is enabled. The condition is reproducible during legitimate operations such as kdump or staged kernel upgrades. Exploitation context is denial of service through forced kernel panic during boot rather than remote code execution.

No verified public proof-of-concept code is available. The upstream commits at Linux Kernel Commit #22e460b and Linux Kernel Commit #f8f73bf describe the corrective page_is_ram() validation added to the x86 path.

Detection Methods for CVE-2026-43240

Indicators of Compromise

Kernel panic logs referencing ima_restore_measurement_list with a not-present page fault (error_code(0x0000))
Boot failures on x86 systems immediately after a kexec transition that includes a mem=<size> parameter
IMA attestation failures following a kexec, indicating the measurement list was not restored

Detection Strategies

Audit kexec invocation arguments collected by auditd for command lines containing mem= combined with IMA-enabled kernels
Correlate kernel crash dumps stored by kdump against the ima_restore_measurement_list symbol to identify affected hosts
Compare running kernel versions to vendor advisories that incorporate the upstream fix commits

Monitoring Recommendations

Forward kernel ring buffer messages and panic traces to a centralized log platform for symbol-level alerting
Track attestation server reports for hosts that lose measurement continuity after kexec events
Monitor for unexpected reboot loops on x86 servers configured with kdump or live-patching workflows

How to Mitigate CVE-2026-43240

Immediate Actions Required

Apply the upstream Linux kernel patches that add page_is_ram() validation to the x86 kexec IMA buffer handling
Update affected systems to distribution kernels that incorporate the referenced stable commits
Avoid passing mem=<size> to kexec-loaded kernels on hosts with IMA carryover until patched

Patch Information

The fix is distributed across multiple stable branches. Reference commits include Linux Kernel Commit #22e460b, Linux Kernel Commit #37f1891, Linux Kernel Commit #4d7a8f5, Linux Kernel Commit #c5489d0, Linux Kernel Commit #d4a132f, and Linux Kernel Commit #f8f73bf. Each adds a memory-bounds check that rejects an out-of-range IMA buffer rather than dereferencing it.

Workarounds

Remove mem=<size> from kexec command lines on x86 hosts where the IMA measurement list is carried across boots
Disable IMA measurement carryover during kexec where attestation continuity is not required
Restrict kexec_load and kexec_file_load to administrators to limit who can stage a vulnerable boot configuration

bash

# Verify whether the running kernel includes the fix by checking the
# changelog or commit hash provided by your distribution
zcat /proc/config.gz | grep -E 'CONFIG_IMA_KEXEC|CONFIG_KEXEC'
uname -r
# Inspect kexec-loaded command line for risky mem= usage
sudo cat /sys/kernel/kexec_cmdline 2>/dev/null || \
  sudo grep -E 'mem=' /proc/cmdline