CVE-2026-68435LoongArch: Fix address space mismatch in kexec command line lookup
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexec_load(2) path (file_mode == 0) passes the user-space segment buffer straight to strncmp() through a bogus (char __user *) cast. This dereferences a user pointer in kernel context, which is wrong and is flagged by sparse: arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in argument 2 (different address spaces) @@ expected char const * @@ got char [noderef] __user * Here copy the marker-sized prefix of each segment into a small on-stack buffer with copy_from_user() before comparing, and skip segments that fault. The subsequent copy_from_user() that stages the full command line into the safe area is left unchanged.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 before a94d6726ec8680a2b0c453fc782a543f68a1ea06; from 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 before 7a54e0cbaad4a5a09e7cc7a4f05d181048e98ca7; from 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 before 485ed44db5694d8d2e5027f63ad608e705286f30 | CNA record |
References
- https://git.kernel.org/stable/c/a94d6726ec8680a2b0c453fc782a543f68a1ea06
- https://git.kernel.org/stable/c/7a54e0cbaad4a5a09e7cc7a4f05d181048e98ca7
- https://git.kernel.org/stable/c/485ed44db5694d8d2e5027f63ad608e705286f30
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.