CVE-2026-68435 LoongArch: Fix address space mismatch in kexec command line lookup
A local attacker can trigger a kernel memory corruption via kexec command line lookup, potentially leading to privilege escalation or system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68435?
CVE-2026-68435 is a memory corruption vulnerability in Linux, published on 12 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Fix address space mismatch in kexec command line lookup
When searching the loaded segments for the "kexec" command line marker, the kexec_load(2) path (file_mode == 0) passes the user-space segment buffer straight to strncmp() through a bogus (char __user *) cast. This dereferences a user pointer in kernel context, which is wrong and is flagged by sparse:
arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in argument 2 (different address spaces) @@ expected char const * @@ got char [noderef] __user *
Here copy the marker-sized prefix of each segment into a small on-stack buffer with copy_from_user() before comparing, and skip segments that fault. The subsequent copy_from_user() that stages the full command line into the safe area is left unchanged.
Which versions are affected by CVE-2026-68435?
How do I fix CVE-2026-68435?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-68435 being exploited?
There is no known exploitation of CVE-2026-68435 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68435, DEBIAN-CVE-2026-68435, GHSA-4fgj-v86w-987m, UBUNTU-CVE-2026-68435.