Description
In the Linux kernel, the following vulnerability has been resolved:
kernel/kexec: fix IMA when allocation happens in CMA area
*** Bug description ***
When I tested kexec with the latest kernel, I ran into the following warning:
[ 40.712410] ------------[ cut here ]------------
[ 40.712576] WARNING: CPU: 2 PID: 1562 at kernel/kexec_core.c:1001 kimage_map_segment+0x144/0x198
[...]
[ 40.816047] Call trace:
[ 40.818498] kimage_map_segment+0x144/0x198 (P)
[ 40.823221] ima_kexec_post_load+0x58/0xc0
[ 40.827246] __do_sys_kexec_file_load+0x29c/0x368
[...]
[ 40.855423] ---[ end trace 0000000000000000 ]---
*** How to reproduce ***
This bug is only triggered when the kexec target address is allocated in
the CMA area. If no CMA area is reserved in the kernel, use the "cma="
option in the kernel command line to reserve one.
*** Root cause ***
The commit 07d24902977e ("kexec: enable CMA based contiguous
allocation") allocates the kexec target address directly on the CMA area
to avoid copying during the jump. In this case, there is no IND_SOURCE
for the kexec segment. But the current implementation of
kimage_map_segment() assumes that IND_SOURCE pages exist and map them
into a contiguous virtual address by vmap().
*** Solution ***
If IMA segment is allocated in the CMA area, use its page_address()
directly.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 6.17 | 6.18.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.18.5-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | linux | 6.17.0-29.29 | USN-8277-1 |
| Ubuntu 25.10 | linux-aws +1 | 6.17.0-1015.15 | USN-8310-1, USN-8277-1 |
| Ubuntu 25.10 | linux-azure-fde | No fix yet | — |
| Ubuntu 25.10 | linux-gcp | 6.17.0-1018.19 | USN-8374-1 |
| Ubuntu 25.10 | linux-oracle | 6.17.0-1014.14 | USN-8277-1 |
| Ubuntu 25.10 | linux-raspi | 6.17.0-1017.17 | USN-8277-1 |
| Ubuntu 25.10 | linux-realtime | 6.17.0-1013.15 | USN-8277-1 |
| Ubuntu 25.10 | linux-riscv | 6.17.0-29.29.1 | — |
| Ubuntu 24.04 LTS | linux-aws-6.17 | 6.17.0-1017.17~24.04.1 | USN-8374-1 |
| Ubuntu 24.04 LTS | linux-azure-6.17 | 6.17.0-1015.15~24.04.1 | USN-8310-1 |
| Ubuntu 24.04 LTS | linux-gcp-6.17 | 6.17.0-1018.19~24.04.1 | USN-8374-1 |
| Ubuntu 24.04 LTS | linux-hwe-6.17 | 6.17.0-29.29~24.04.1 | USN-8277-1 |
| Ubuntu 24.04 LTS | linux-nvidia-6.17 | 6.17.0-1014.14 | — |
| Ubuntu 24.04 LTS | linux-oem-6.17 | 6.17.0-1023.23 | USN-8277-1 |
| Ubuntu 24.04 LTS | linux-oracle-6.17 | 6.17.0-1014.14~24.04.1 | USN-8277-2 |
| Ubuntu 24.04 LTS | linux-riscv +10 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-6.17 | 6.17.0-29.29.1~24.04.1 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.17 | 6.17.0-1013.15~24.04.1 | USN-8277-1 |
Advisories 5
- WID-SEC-2026-0119 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-8374-1 linux-aws-6.17, linux-gcp, linux-gcp-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8310-1 linux-azure, linux-azure-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 5, 2026
- USN-8277-2 linux-oracle-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 5, 2026
- USN-8277-1 linux, linux-aws, linux-hwe-6.17, linux-oem-6.17, linux-oracle, linux-raspi, linux-realtime, linux-realtime-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 5, 2026