CVE-2026-53282: Linux Kernel Kexec Purgatory Stack Fault

Technical summary

CVE-2026-53282 stems from a regression in x86 kexec stack management. A prior commit optimized the kjump (kernel jump) code path by eliminating a gratuitous push of a return address to the stack. However, the purgatory code shipped by kexec-tools unconditionally reads from above the stack pointer to retrieve a return address, even in non-kjump kexec scenarios. When the kernel no longer places this value there, purgatory encounters a fault attempting to dereference invalid memory. While newer kernel exception handling now catches this fault rather than causing an uncontrolled panic, the underlying stack frame mismatch must be resolved to restore proper functionality.

Business impact

Organizations relying on kexec for live kernel patching, zero-downtime updates, or rapid kernel switching may experience service disruptions if a non-kjump kexec operation triggers a purgatory crash. This is particularly relevant for cloud providers, container platforms, and production environments where kernel updates are frequent. The actual impact depends on how systems are configured to handle kexec failures—modern kernel exception handling mitigates silent corruption, but the operation will still fail, necessitating a traditional reboot.

Affected systems

The Linux kernel across all architectures implementing x86 kexec is affected. Impact is limited to systems that perform kexec operations (typically administrators or automated patching tools), not general end users. Affected versions are those incorporating the prior optimization commit but not yet including the fix that restores the return address push for non-kjump paths. Verify your specific kernel version against the upstream Linux kernel stable branches and your distribution's advisory.

Exploitability

This vulnerability is not exploitable for privilege escalation or code execution. It requires local access and the ability to trigger a kexec operation, which is restricted to privileged users. The issue manifests as a denial of service—a failed kernel replacement operation—not as a vector for unauthorized access or control. Exploitation requires intentional or accidental invocation of kexec, making it low-risk in typical server deployments where kexec is not routinely used.

Remediation

Apply the Linux kernel patch that restores the return address push to the stack in the non-kjump kexec code path. This fix is lightweight and does not alter the intended optimization for kjump. Coordinate with your Linux distribution to obtain an updated kernel package, or cherry-pick the upstream fix if you maintain custom kernels. Test kexec operations in a non-production environment before deployment to ensure stability.

Patch guidance

Check with your Linux distribution (Red Hat, Canonical, SUSE, Debian, etc.) for kernel updates addressing this regression. Upstream Linux kernel stable branches will carry the fix; verify the exact commit or patch version in the distribution's advisory. If your organization uses live kernel patching tools (e.g., kpatch, KernelCare), ensure those tools are also up to date. Schedule patching during a maintenance window that permits a full reboot, as kexec-based updates may fail until the fix is deployed.

Detection guidance

Monitor system logs for kexec-related faults or exceptions, particularly in dmesg or kernel logs if live patching or kernel replacement tools are in use. Watch for repeated reboot failures or timeout errors during automated kernel update processes. If your environment uses kexec extensively, test the operation on a representative system after any kernel upgrade to catch this regression early. No special tooling is required; standard kernel logging and exception handlers will surface the issue.

Why prioritize this

Assign this a medium priority for organizations using kexec; deprioritize for those that do not. The CVSS 5.5 score reflects local-only access requirements and denial-of-service impact, with no confidentiality or integrity compromise. Prioritize if your infrastructure relies on zero-downtime kernel updates or live patching; deprioritize for systems that can tolerate traditional reboots. Address within a standard maintenance cycle rather than as an emergency.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects attack vector limited to local, attack complexity low, no privilege escalation, and availability impact only. The vulnerability does not expose sensitive data, corrupt system state in ways that persist across reboots, or grant unauthorized access. The impact is confined to the failure of a privileged operation (kexec), not system compromise. The score appropriately reflects the localized, denial-of-service nature of the issue.

Frequently asked questions