The flaw lies in kexec_load_purgatory, where the kernel calculates image->start by searching for e_entry inside any SHF_EXECINSTR section. If a purgatory binary contains multiple executable sections with overlapping addresses, this search can return more than one match and trigger a WARN. The patch adds a fallback that derives the entry from the purgatory_start symbol when present, avoiding the ambiguous lookup. The failure manifests only as a warning in current releases, though it indicates that the kernel could incorrectly select an entry point for a kexec operation.

All Linux kernel builds that do not incorporate the commit that adds purgatory_start fallback are affected. This includes every kernel version released prior to the merge of commit 0277975 and any backports that have not applied this change. Vendor distribution does not impose further constraints beyond the kernel itself.

Exploitation requires the ability to load a custom kernel image, a capability normally limited to privileged users (root or processes with CAP_SYS_ADMIN and CAP_SYS_KEXEC). No public exploit is documented and the EPSS score is unavailable, suggesting remaining uncertainty about real‑world exploitation. The CVSS score of 5.5 indicates moderate severity, and the vulnerability is not listed in CISA’s KEV catalog. The impact, if realized, would be limited to the affected host and would not provide an attacker with additional privileges beyond those already required to load a kernel.