CVE-2026-68435

Not scored yetLast modified Oct 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Fix address space mismatch in kexec command line lookup

When searching the loaded segments for the "kexec" command line marker, the kexec_load(2) path (file_mode == 0) passes the user-space segment buffer straight to strncmp() through a bogus (char __user *) cast. This dereferences a user pointer in kernel context, which is wrong and is flagged by sparse:

arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in argument 2 (different address spaces) @@ expected char const * @@ got char [noderef] __user *

Here copy the marker-sized prefix of each segment into a small on-stack buffer with copy_from_user() before comparing, and skip segments that fault. The subsequent copy_from_user() that stages the full command line into the safe area is left unchanged.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188, < 742f2c0a64a7557495e831c3c112d92e308bd4ae; >= 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188, < 3b71f51fa3a247921408879eab2ddee82da8a980; >= 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188, < eaa908d8d523b0ab75dab5ebd6662e70af5e5d7e; >= 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188, < a94d6726ec8680a2b0c453fc782a543f68a1ea06; >= 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188, < 7a54e0cbaad4a5a09e7cc7a4f05d181048e98ca7; >= 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188, < 485ed44db5694d8d2e5027f63ad608e705286f30
LinuxLinux6.1

References

Timeline

Published
Aug 12, 2026
Last modified
Oct 30, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-68436In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use kvzalloc to allocate struct dc struct dc has growCVE-2026-68437In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fit paired fragment job in the correct CCCB For geomeCVE-2026-68438In the Linux kernel, the following vulnerability has been resolved: smp: Make CSD lock acquisition atomic for debug mode Commit b0473dcd4bCVE-2026-68439In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_hCVE-2026-68445.5A flaw was found in the `readelf` utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilitieCVE-2026-684407.8In the Linux kernel, the following vulnerability has been resolved: net: txgbe: fix heap overflow when reading module EEPROM txgbe_read_eeCVE-2026-68441In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains When a TC fCVE-2026-684427.8In the Linux kernel, the following vulnerability has been resolved: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps When bCVE-2026-68443In the Linux kernel, the following vulnerability has been resolved: hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop CVE-2026-68444In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() ffCVE-2026-684457.8In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4_gem_objCVE-2026-684467.8In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmw_surface_metadata::array_size This field comes
CVE-2026-68435: Unscored | Vulnix