LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71139: kernel/kexec: fix IMA when allocation happens in CMA area

In the Linux kernel, the following vulnerability has been resolved: kernel/kexec: fix IMA when allocation happens in CMA area *** Bug description *** When I tested kexec with the latest kernel, I ran into the following warning: [ 40.712410] ------------[ cut here ]------------ [ 40.712576] WARNING: CPU: 2 PID: 1562 at kernel/kexec_core.c:1001 kimage_map_segment+0x144/0x198 [...] [ 40.816047] Call trace: [ 40.818498] kimage_map_segment+0x144/0x198 (P) [ 40.823221] ima_kexec_post_load+0x58/0xc0 [ 40.827246] __do_sys_kexec_file_load+0x29c/0x368 [...] [ 40.855423] ---[ end trace 0000000000000000 ]--- *** How to reproduce *** This bug is only triggered when the kexec target address is allocated in the CMA area. If no CMA area is reserved in the kernel, use the "cma=" option in the kernel command line to reserve one. *** Root cause *** The commit 07d24902977e ("kexec: enable CMA based contiguous allocation") allocates the kexec target address directly on the CMA area to avoid copying during the jump. In this case, there is no IND_SOURCE for the kexec segment. But the current implementation of kimage_map_segment() assumes that IND_SOURCE pages exist and map them into a contiguous virtual address by vmap(). *** Solution *** If IMA segment is allocated in the CMA area, use its page_address() directly.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel bug in a specialized reboot path. Under specific kexec, IMA, and CMA memory conditions, the kernel can hit a warning because it expects a memory mapping structure that is absent. The sources do not show remote exploitation, privilege escalation, or business impact beyond this constrained kernel behavior.

Executive priority

Medium operational priority for Linux fleets using kexec or measured boot workflows. The current evidence does not support emergency response for broad exploitation, but kernel reliability issues in reboot or integrity paths should be tracked to closure.

Technical view

The issue occurs in kimage_map_segment() during ima_kexec_post_load() when a kexec target is allocated directly from CMA memory. CMA-backed kexec allocation can lack IND_SOURCE pages, but the mapping logic assumed they existed and tried to vmap() them. The fix uses page_address() directly for IMA segments allocated in CMA.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions where kexec_file_load, IMA, and CMA-backed contiguous allocation intersect. Systems not using kexec or not reserving CMA may not encounter the bug based on the provided description.

Exploitation context

The bundle provides reproduction conditions for a kernel warning but no exploit chain. CISA KEV is false, and no cited source claims active exploitation. Treat this as an operational kernel reliability issue unless vendor guidance says otherwise.

Researcher notes

The affected conditions are narrow and source evidence is incomplete on security impact. The key research question is whether the warning can cause denial of service or integrity-measurement failure in real deployments. Do not assume remote reachability from the bundle.

Mitigation direction

  • Apply kernel or distribution updates that include the linked stable fixes.
  • Check vendor advisories for supported package names and affected version ranges.
  • Prioritize hosts using kexec, IMA, or CMA reservations.
  • Avoid unsupported workarounds; follow kernel or distribution guidance.

Validation and detection

  • Inventory kernel versions against vendor advisories and linked stable commits.
  • Check whether kexec, IMA, and CMA reservations are enabled on relevant systems.
  • Confirm updated kernels include the referenced fix commits.
  • Regression-test kexec workflows in staging after patching.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71139 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux07d24902977e4704fab8472981e73a0ad6dfa1fd, 07d24902977e4704fab8472981e73a0ad6dfa1fdunaffected
LinuxLinux6.17, 0, 6.18.4, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.