CVE-2026-43129

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ima: verify the previous kernel's IMA buffer lies in addressable RAM

Patch series "Address page fault in ima_restore_measurement_list()", v3.

When the second-stage kernel is booted via kexec with a limiting command

line such as "mem=<size>" we observe a pafe fault that happens.

BUG: unable to handle page fault for address: ffff97793ff47000

RIP: ima_restore_measurement_list+0xdc/0x45a

#PF: error_code(0x0000) not-present page

This happens on x86_64 only, as this is already fixed in aarch64 in

commit: cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer

against memory bounds")

This patch (of 3):

When the second-stage kernel is booted with a limiting command line (e.g.

"mem=<size>"), the IMA measurement buffer handed over from the previous

kernel may fall outside the addressable RAM of the new kernel. Accessing

such a buffer can fault during early restore.

Introduce a small generic helper, im

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References