CVE-2026-53282

In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Push kjump return address even for non-kjump kexec The version of purgatory code shipped by kexec-tools attempts to look above the top of its stack to find a return address for a kjump, even in a non-kjump kexec. After the commit in Fixes: the word above the stack might not be there, leading to a fault (which is at least now caught by my exception-handling code in kexec). That commit fixed things for the actual kjump path, but no longer "gratuitously" pushes the unused return address to the stack in the non-kjump path. Put that *back* in the non-kjump path, to prevent purgatory from crashing when trying to access it.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/786a45757dcdf8f2beb9d4a6db605db16c18b2b4
https://git.kernel.org/stable/c/7dba9631faa2ee0785e8c2bf0e3d90a05f26dd8c
https://git.kernel.org/stable/c/b0bd7a850e1f082560959707dbf57b0402071646

Configurations

No configuration.

History

26 Jun 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-26 20:17

Updated : 2026-06-30 14:44

NVD link : CVE-2026-53282

Mitre link : CVE-2026-53282

CVE.ORG link : CVE-2026-53282

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-53282", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2cacf7f23a024ab1fdc603ca6a4f4c8b2de9f64e", "lessThan": "b0bd7a850e1f082560959707dbf57b0402071646", "versionType": "git"}, {"status": "affected", "version": "2cacf7f23a024ab1fdc603ca6a4f4c8b2de9f64e", "lessThan": "7dba9631faa2ee0785e8c2bf0e3d90a05f26dd8c", "versionType": "git"}, {"status": "affected", "version": "2cacf7f23a024ab1fdc603ca6a4f4c8b2de9f64e", "lessThan": "786a45757dcdf8f2beb9d4a6db605db16c18b2b4", "versionType": "git"}], "programFiles": ["arch/x86/kernel/relocate_kernel_64.S"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"status": "unaffected", "version": "0", "lessThan": "6.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.33", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.10", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/x86/kernel/relocate_kernel_64.S"], "defaultStatus": "affected"}]}], "published": "2026-06-26T20:17:20.063", "references": [{"url": "https://git.kernel.org/stable/c/786a45757dcdf8f2beb9d4a6db605db16c18b2b4", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7dba9631faa2ee0785e8c2bf0e3d90a05f26dd8c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b0bd7a850e1f082560959707dbf57b0402071646", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kexec: Push kjump return address even for non-kjump kexec\n\nThe version of purgatory code shipped by kexec-tools attempts to look above\nthe top of its stack to find a return address for a kjump, even in a non-kjump\nkexec.\n\nAfter the commit in Fixes: the word above the stack might not be there,\nleading to a fault (which is at least now caught by my exception-handling code\nin kexec).\n\nThat commit fixed things for the actual kjump path, but no longer\n\"gratuitously\" pushes the unused return address to the stack in the non-kjump\npath. Put that *back* in the non-kjump path, to prevent purgatory from\ncrashing when trying to access it."}], "lastModified": "2026-06-30T14:44:27.313", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}