Always-Incorrect Control Flow Implementation in Linux kernel - CVE-2026-43289
Published: May 9, 2026
Vulnerability identifier: #VU130898
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-43289
CWE-ID: CWE-670
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of overlapping executable sections in kexec_load_purgatory() when loading a purgatory object. A local user can supply a purgatory object with multiple executable sections that overlap in sh_addr to cause a denial of service.
The issue can trigger a kernel WARN during kexec_file_load.
How to mitigate CVE-2026-43289
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/027797595a108726f4a0a45d225f603b0ffbd22b
- https://git.kernel.org/stable/c/1737d37ae1d2814e6cf0a1af87af3d41f0812b95
- https://git.kernel.org/stable/c/36eb314184a0ae74dd42914b47d2b9fc43be8034
- https://git.kernel.org/stable/c/480e1d5c64bb14441f79f2eb9421d5e26f91ea3d
- https://git.kernel.org/stable/c/5226570bd252cea2e805a161cb0f75c204c3108a
- https://git.kernel.org/stable/c/875355152b33436907c2a6d2ffad1431fa86c62b
- https://git.kernel.org/stable/c/cfccd3b8c51bc57a8a6fcb2fd30453afae5bc0d2
- https://git.kernel.org/stable/c/f736032c638a33a243e9126e617788f763d648f9