When the second‑stage kernel is launched using kexec with a memory limiting argument like "mem=<size>", the IMA measurement buffer supplied from the previous kernel can lie outside the addressable RAM of the new kernel. Accessing such a buffer triggers a page fault during the early restore phase, causing a kernel panic. This manifests as a buffer‑over‑read fault that leads to a denial of service for the entire system.

The bug is present in the IMA subsystem of the Linux kernel on x86_64 processors. It is fixed in aarch64 by commit cbf9c4b9, but the problem remains in all x86_64 kernels that do not yet include the patch from the third commit of the series (introducing ima_validate_range()). Affected kernels are those prior to the inclusion of this helper in the mainline.

There is no EPSS data and the vulnerability is not listed in CISA KEV. The flaw results in a critical denial of service through an unhandled page fault. Exploitation requires the attacker to control or influence the kexec boot process, which is typically limited to privileged or local users. While the probability of exploitation is low under normal operation, it is potentially high if an attacker can insert a crafted mem= parameter or otherwise trigger kexec on a vulnerable kernel.