CVE-2026-43289: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: kexec: derive purgatory entry from symbol kexec_load_purgatory() derives image->start by locating e_entry inside an SHF_EXECINSTR section. If the purgatory object contains multiple executable sections with overlapping sh_addr, the entrypoint check can match more than once and trigger a WARN. Derive the entry section from the purgatory_start symbol when present and compute image->start from its final placement. Keep the existing e_entry fallback for purgatories that do not expose the symbol. WARNING: kernel/kexec_file.c:1009 at kexec_load_purgatory+0x395/0x3c0, CPU#10: kexec/1784 Call Trace: <TASK> bzImage64_load+0x133/0xa00 __do_sys_kexec_file_load+0x2b3/0x5c0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e [me@linux.beauty: move helper to avoid forward declaration, per Baoquan]

Affected products

• Linux Linux Kernel: from 4.19.287, before 4.20 (fixed in 4.20); from 5.4.248, before 5.5 (fixed in 5.5); from 5.10.185, before 5.10.252 (fixed in 5.10.252); from 5.15.118, before 5.15.202 (fixed in 5.15.202); from 6.1.35, before 6.1.165 (fixed in 6.1.165); from 6.3.9, before 6.4 (fixed in 6.4); …

Published 2026-05-08. Last modified 2026-06-17.