Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-43289

kexec: derive purgatory entry from symbol

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.252, 5.15.202, 6.1.165, 4.20, 5.5, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: kexec: derive purgatory entry from symbol kexec_load_purgatory() derives image->start by locating e_entry inside an SHF_EXECINSTR section. If the purgatory object contains multiple executable sections with overlapping sh_addr, the entrypoint check can match more than once and trigger a WARN. Derive the entry section from the purgatory_start symbol when present and compute image->start from its final placement. Keep the existing e_entry fallback for purgatories that do not expose the symbol. WARNING: kernel/kexec_file.c:1009 at kexec_load_purgatory+0x395/0x3c0, CPU#10: kexec/1784 Call Trace: <TASK> bzImage64_load+0x133/0xa00 __do_sys_kexec_file_load+0x2b3/0x5c0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e [me@linux.beauty: move helper to avoid forward declaration, per Baoquan]

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 5.10.185 · fixed in 5.10.252; From 5.15.118 · fixed in 5.15.202; From 6.1.35 · fixed in 6.1.165; From 4.19.287 · fixed in 4.20; From 5.4.248 · fixed in 5.5; From 6.3.9 · fixed in 6.4

  • Linux Linux

    6.4

References 8

git.kernel.org