Strix
57.4K

CVE-2026-72013

UnknownEPSS 0.21%

Last modified

CVE-2026-72013 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent NULL pointer dereference in machine_kexec_prepare() A NULL pointer dereference issue is noticed in riscv's machine_kexec_prepare(), where image->segment[i].buf might be NULL and copied unchecked. The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without a check in machine_kexec_prepare(): kexec_file_load -> kimage_file_alloc_init() -> kimage_file_prepare_segments() -> ima_add_kexec_buffer() -> kexec_add_buffer() -> machine_kexec_prepare() -> memcpy() Address this by adding a check before the data copy attempt.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent NULL pointer dereference in machine_kexec_prepare() A NULL pointer dereference issue is noticed in riscv's machine_kexec_prepare(), where image->segment[i].buf might be NULL and copied unchecked. The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without a check in machine_kexec_prepare(): kexec_file_load -> kimage_file_alloc_init() -> kimage_file_prepare_segments() -> ima_add_kexec_buffer() -> kexec_add_buffer() -> machine_kexec_prepare() -> memcpy() Address this by adding a check before the data copy attempt.

Metrics

EPSS Probability
0.21%

10.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 4211742f0f9e083188f4f0ada00d6eeeef31b7c7, < 606cc45e871e34b80a2f63874f069387a5b44176; >= b7fb4d78a6ade6026d9e5cf438c2a46ab962e032, < c462e15497dc40abe369b3be7a2c91ac5d1be6f9; >= b7fb4d78a6ade6026d9e5cf438c2a46ab962e032, < b5f92cc4e24a298bf390b0b189a4b888c0900161; >= b7fb4d78a6ade6026d9e5cf438c2a46ab962e032, < 6ad6954492697681ebcfc1beb0eb384406cd4b65; >= b7fb4d78a6ade6026d9e5cf438c2a46ab962e032, < eadd0c2c76aee6a738f17f251434c77db3c606c8; >= b7fb4d78a6ade6026d9e5cf438c2a46ab962e032, < d5b2752a17efc165793ae38f2c24b5ed9c04ffde; >= b7fb4d78a6ade6026d9e5cf438c2a46ab962e032, < 81bbcff0c053c4f5c711c31a9b72fc492bd96c3f; 3ca8a07f141fd8eec347a82bdfa4b94164f2bb97; 3ba83e46b591381e718007f55c9f831fd0cd7ee8; >= 5.15.47, < 5.15.212; >= 5.17.15, < 5.18; >= 5.18.4, < 5.19
LinuxLinux5.19

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72013?
In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent NULL pointer dereference in machine_kexec_prepare() A NULL pointer dereference issue is noticed in riscv's machine_kexec_prepare(), where image->segment[i].buf might be NULL and copied unchecked. The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without a check in machine_kexec_prepare(): kexec_file_load -> kimage_file_alloc_init() -> kimage_file_prepare_segments() -> ima_add_kexec_buffer() -> kexec_add_buffer() -> machine_kexec_prepare() -> memcpy() Address this by adding a check before the data copy attempt.
How severe is CVE-2026-72013?
Severity scoring for CVE-2026-72013 is pending analysis. The EPSS model estimates a 0.21% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72013?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72013?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST