CVE-2026-53282: Linux Kernel Privilege Escalation Flaw

CVE-2026-53282 Overview

CVE-2026-53282 affects the Linux kernel's x86 kexec subsystem. The purgatory code shipped by kexec-tools reads a word above the top of its stack to obtain a return address for a kjump, even during a non-kjump kexec operation. A prior fix stopped pushing the unused return address onto the stack in the non-kjump path, leaving the memory location undefined. When purgatory later tries to read that word, it triggers a fault during kernel execution transfer. The regression is addressed by restoring the push of the return address in the non-kjump path so purgatory can access it safely.

Critical Impact
Purgatory may fault during a non-kjump kexec, disrupting kernel boot transitions on affected x86 Linux systems.

Affected Products

Linux kernel (x86 kexec subsystem)
kexec-tools purgatory code path for non-kjump kexec
Distributions shipping kernels containing the referenced fixes-target commit

Discovery Timeline

2026-06-26 - CVE-2026-53282 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53282

Vulnerability Analysis

The purgatory helper runs between the outgoing kernel and the target kernel during a kexec transition. It expects a return address to be present on the stack for the kjump path. Historically, the assembly entry code pushed this return address unconditionally, so purgatory could always read the word above its stack pointer.

A prior change removed the unconditional push and only pushed the return address for actual kjump operations. As a result, on the non-kjump path the word above the stack is undefined memory. Purgatory still attempts to read that word, causing a fault when it lands on an unmapped or invalid location. Exception-handling logic added to kexec now catches the fault, but the underlying access is still incorrect.

Root Cause

The root cause is a mismatch between purgatory's assumptions and the kernel's stack setup. Purgatory assumes a return address always sits above its stack top, while the non-kjump code path no longer places one there. This produces an out-of-bounds read against an undefined stack slot during kexec.

Attack Vector

The issue is a reliability and stability defect triggered during kexec execution rather than a remotely reachable attack vector. Exploitation requires privileges sufficient to invoke kexec_load or kexec_file_load, which are restricted to root. The observable effect is a fault in purgatory during a non-kjump kexec transition. Refer to the kernel commit 786a4575, commit 7dba9631, and commit b0bd7a85 for the code paths involved.

Detection Methods for CVE-2026-53282

Indicators of Compromise

Kernel logs reporting purgatory faults during kexec transitions on x86 systems.
Failed or aborted kexec operations that do not involve a kjump (crash kernel) path.
Systems running kernels that contain the fixes-target commit but not the restoring patch.

Detection Strategies

Inventory kernel and kexec-tools versions across x86 Linux hosts and cross-reference against the referenced stable commits.
Monitor dmesg and journal output for kexec-related exception messages after kernel updates.
Track kexec usage in configuration management to identify hosts most exposed to the regression.

Monitoring Recommendations

Alert on kexec failures in centralized log pipelines to surface regressions early.
Include kexec transition tests in kernel update validation workflows.
Correlate kernel version telemetry with EPSS data (0.166%, percentile 6.138) to prioritize patching.

How to Mitigate CVE-2026-53282

Immediate Actions Required

Apply the upstream kernel patches that restore the return address push in the non-kjump purgatory path.
Update kexec-tools from your distribution to the version aligned with the fixed kernel.
Defer non-kjump kexec operations on unpatched hosts until the fix is deployed.

Patch Information

The fix is committed to the Linux stable tree. Review the kernel commit 786a4575, commit 7dba9631, and commit b0bd7a85 and pull the corresponding stable kernel release from your distribution vendor.

Workarounds

Restrict kexec_load and kexec_file_load usage to controlled maintenance windows on unpatched systems.
Use only the kjump (crash kernel) path until the fix is available, since that path is unaffected.
Rebuild kexec-tools purgatory with the corrected push sequence if a distribution package is not yet available.

bash

# Verify kernel version and check for kexec-related faults
uname -r
dmesg | grep -i -E 'kexec|purgatory'

# Update kernel and kexec-tools (Debian/Ubuntu example)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r) kexec-tools