Linux Kernel CVE-2026-43240

Update the Linux kernel to a patched version: 6.1.165 or later (for 6.1.x series), 6.6.128 or later (for 6.6.x series), 6.12.75 or later (for 6.12.x series), 6.18.16 or later (for 6.18.x series), 6.19.6 or later (for 6.19.x series), or 7.0 or later (for mainline). The upstream fix adds bounds validation via page_is_ram() to the IMA kexec buffer restoration path in x86/kexec code. For systems unable to immediately patch, mitigations include: (1) disable kexec entirely by removing CONFIG_KEXEC from kernel configuration (eliminates the attack path entirely but prevents live kernel updates), (2) restrict kexec capability to trusted users only via capability-based access control (limits privilege exposure but requires deployment automation changes), or (3) disable IMA if not required for attestation use cases (reduces feature surface but may break compliance workflows). Most distributions provide kernel updates through standard package managers; verify patch availability through your vendor's security advisory portal.