CVE-2026-72013

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

riscv: Prevent NULL pointer dereference in machine_kexec_prepare()

A NULL pointer dereference issue is noticed in riscv's

machine_kexec_prepare(), where image->segment[i].buf might be NULL and

copied unchecked.

The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by

kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without

a check in machine_kexec_prepare():

kexec_file_load

-> kimage_file_alloc_init()

-> kimage_file_prepare_segments()

-> ima_add_kexec_buffer()

-> kexec_add_buffer()

-> machine_kexec_prepare()

-> memcpy()

Address this by adding a check before the data copy attempt.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References