The kernel panics when a second‑stage kernel is booted with a limited memory size via kexec. The IMA measurement list from the previous kernel is carried into the new kernel, but the physical memory range it occupies may fall outside the truncated RAM. Because the x86 kernel lacked a sanity check, the kernel attempts to restore the list from memory that no longer exists, resulting in a page fault and a kernel panic. This flaw represents improper input validation and out‑of‑bounds memory access causing a loss of availability. Based on the description, it is inferred that an attacker could forcibly bring the system down.

All x86 editions of the Linux kernel that use kexec and have IMA enabled without the patch are affected. No specific version numbers are supplied, so any release emitted before the inclusion of the sanity‑check commit should be considered vulnerable. The affected product is the Linux kernel running on Intel or AMD processors.

The vulnerability has a CVSS score of 5.5, indicating moderate severity. A kernel panic disables the operating system and requires a reboot. EPSS is unavailable and the flaw is not listed in the CISA KEV catalog. It appears to be triggerable by a local attacker with kexec privileges, or by an entity that can reboot the system with a memory limit. Given the impact on availability, the risk is significant even without confirmed exploitation evidence.