CVE-2026-68435

LoongArch: Fix address space mismatch in kexec command line lookup

State: Published
Severity: Not scored
Published: Aug 12, 2026
Updated: Oct 30, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Fix address space mismatch in kexec command line lookup

When searching the loaded segments for the "kexec" command line marker, the kexec_load(2) path (file_mode == 0) passes the user-space segment buffer straight to strncmp() through a bogus (char __user *) cast. This dereferences a user pointer in kernel context, which is wrong and is flagged by sparse:

arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in argument 2 (different address spaces) @@ expected char const * @@ got char [noderef] __user *

Here copy the marker-sized prefix of each segment into a small on-stack buffer with copy_from_user() before comparing, and skip segments that fault. The subsequent copy_from_user() that stages the full command line into the safe area is left unchanged.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 to before 742f2c0a64a7557495e831c3c112d92e308bd4aeAffected 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 to before 3b71f51fa3a247921408879eab2ddee82da8a980Affected 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 to before eaa908d8d523b0ab75dab5ebd6662e70af5e5d7eAffected 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 to before a94d6726ec8680a2b0c453fc782a543f68a1ea06Affected 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 to before 7a54e0cbaad4a5a09e7cc7a4f05d181048e98ca7Affected 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 to before 485ed44db5694d8d2e5027f63ad608e705286f30Affected
LinuxLinux	6.1Affected before 6.1Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 to before 742f2c0a64a7557495e831c3c112d92e308bd4aeAffected
4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 to before 3b71f51fa3a247921408879eab2ddee82da8a980Affected
4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 to before eaa908d8d523b0ab75dab5ebd6662e70af5e5d7eAffected
4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 to before a94d6726ec8680a2b0c453fc782a543f68a1ea06Affected
4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 to before 7a54e0cbaad4a5a09e7cc7a4f05d181048e98ca7Affected
4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 to before 485ed44db5694d8d2e5027f63ad608e705286f30Affected

LinuxLinux

6.1Affected
before 6.1Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.