Linux Kernel CVE-2026-43129

Exploitation requires the following specific conditions: (1) Linux kernel on x86_64 architecture (aarch64 is not affected), (2) IMA (Integrity Measurement Architecture) enabled and active in the kernel, (3) kexec used for system reboot/update, and (4) second-stage kernel booted with a memory-limiting command line parameter such as 'mem=<size>' that restricts addressable memory below the physical address range of the IMA buffer. The vulnerability is triggered automatically during early kernel boot without user interaction when these conditions are met. Systems using standard BIOS or UEFI boot methods without kexec, systems without IMA enabled, or systems booting kexec without memory constraints are not affected. Local user account access alone is insufficient; the ability to specify kernel command-line parameters typically requires administrative/root privileges, making this a privileged local attack rather than an unprivileged one despite the CVSS PR:L rating.

This vulnerability presents a moderate local denial-of-service risk with several mitigating factors. CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local access with low complexity, requiring low privileges, affecting availability only with no scope change. EPSS score of 0.02% (5th percentile) is notably low despite the KEV-equivalent listing, suggesting limited real-world exploitability beyond very specific deployment scenarios. Exploitation requires: (1) local user account access, (2) ability to trigger kexec with a memory-limiting command line (typically requires administrative privileges despite PR:L in CVSS), and (3) active use of IMA with kexec-based updates. The vulnerability does not affect systems using standard boot methods or those without memory constraints. The discrepancy between CVSS score and EPSS score indicates this is primarily a hardening fix for an edge-case scenario rather than a widespread security threat. However, on affected infrastructure (cloud providers, virtualization platforms, or edge computing using constrained kexec updates), availability impact could be significant if triggered during critical kernel updates.

A system administrator or local user with moderate privileges on a server using IMA and kexec-based updates attempts to reboot the kernel with a memory constraint such as 'mem=512M' on a system with more physical RAM. The kexec mechanism passes the previous kernel's IMA measurement buffer to the second-stage kernel. When the new kernel attempts to restore the IMA measurement list early in the boot process, it tries to access the buffer which now lies outside the new kernel's addressable memory range (above the 512M limit). This causes an immediate page fault and kernel panic, resulting in a failed reboot and system downtime.