CVE-2026-72013 - Vulnerability Details

- riscv: Prevent NULL pointer dereference in machine_kexec_prepare()

Description

In the Linux kernel, the following vulnerability has been resolved:

riscv: Prevent NULL pointer dereference in machine_kexec_prepare()

A NULL pointer dereference issue is noticed in riscv's
machine_kexec_prepare(), where image->segment[i].buf might be NULL and
copied unchecked.

The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by
kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without
a check in machine_kexec_prepare():

kexec_file_load
-> kimage_file_alloc_init()
-> kimage_file_prepare_segments()
-> ima_add_kexec_buffer()
-> kexec_add_buffer()
-> machine_kexec_prepare()
-> memcpy()

Address this by adding a check before the data copy attempt.

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4211742f0f9e083188f4f0ada00d6eeeef31b7c7`	affected	< 606cc45e871e34b80a2f63874f069387a5b44176
`b7fb4d78a6ade6026d9e5cf438c2a46ab962e032`	affected	< c462e15497dc40abe369b3be7a2c91ac5d1be6f9
`b7fb4d78a6ade6026d9e5cf438c2a46ab962e032`	affected	< b5f92cc4e24a298bf390b0b189a4b888c0900161
`b7fb4d78a6ade6026d9e5cf438c2a46ab962e032`	affected	< 6ad6954492697681ebcfc1beb0eb384406cd4b65
`b7fb4d78a6ade6026d9e5cf438c2a46ab962e032`	affected	< eadd0c2c76aee6a738f17f251434c77db3c606c8
`b7fb4d78a6ade6026d9e5cf438c2a46ab962e032`	affected	< d5b2752a17efc165793ae38f2c24b5ed9c04ffde
`b7fb4d78a6ade6026d9e5cf438c2a46ab962e032`	affected	< 81bbcff0c053c4f5c711c31a9b72fc492bd96c3f
`3ca8a07f141fd8eec347a82bdfa4b94164f2bb97`	affected	—
`3ba83e46b591381e718007f55c9f831fd0cd7ee8`	affected	—
`5.15.47`	affected	< 5.15.212
`5.17.15`	affected	< 5.18
`5.18.4`	affected	< 5.19

Linux

affected

Version	Status	Constraints
`5.19`	affected	—
`0`	unaffected	< 5.19
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4211742f0f9e083188f4f0ada00d6eeeef31b7c7,606cc45e871e34b80a2f63874f069387a5b44176)`	affected	code_commit	—
`[b7fb4d78a6ade6026d9e5cf438c2a46ab962e032,c462e15497dc40abe369b3be7a2c91ac5d1be6f9)`	affected	code_commit	—
`[b7fb4d78a6ade6026d9e5cf438c2a46ab962e032,b5f92cc4e24a298bf390b0b189a4b888c0900161)`	affected	code_commit	—
`[b7fb4d78a6ade6026d9e5cf438c2a46ab962e032,6ad6954492697681ebcfc1beb0eb384406cd4b65)`	affected	code_commit	—
`[b7fb4d78a6ade6026d9e5cf438c2a46ab962e032,eadd0c2c76aee6a738f17f251434c77db3c606c8)`	affected	code_commit	—
`[b7fb4d78a6ade6026d9e5cf438c2a46ab962e032,d5b2752a17efc165793ae38f2c24b5ed9c04ffde)`	affected	code_commit	—
`[b7fb4d78a6ade6026d9e5cf438c2a46ab962e032,81bbcff0c053c4f5c711c31a9b72fc492bd96c3f)`	affected	code_commit	—
`3ca8a07f141fd8eec347a82bdfa4b94164f2bb97`	affected	code_commit	—
`3ba83e46b591381e718007f55c9f831fd0cd7ee8`	affected	code_commit	—
`[5.15.47,5.15.212)`	affected	semver	—
`[5.17.15,5.18)`	affected	generic	—
`[5.18.4,5.19)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.19`	affected	generic	—
`[0,5.19)`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.97,6.12.*]`	unaffected	generic	—
`[6.18.40,6.18.*]`	unaffected	generic	—
`[7.1.5,7.1.*]`	unaffected	generic	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00205.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/606cc45e871e34b80a2f63874f069387a5b44176
https://git.kernel.org/stable/c/6ad6954492697681ebcfc1beb0eb384406cd4b65
https://git.kernel.org/stable/c/81bbcff0c053c4f5c711c31a9b72fc492bd96c3f
https://git.kernel.org/stable/c/b5f92cc4e24a298bf390b0b189a4b888c0900161
https://git.kernel.org/stable/c/c462e15497dc40abe369b3be7a2c91ac5d1be6f9
https://git.kernel.org/stable/c/d5b2752a17efc165793ae38f2c24b5ed9c04ffde
https://git.kernel.org/stable/c/eadd0c2c76aee6a738f17f251434c77db3c606c8
https://lore.kernel.org/linux-cve-announce/2026081508-CVE-2026-72013-41d8@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72013
https://www.cve.org/CVERecord?id=CVE-2026-72013

History

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081508-CVE-2026-72013-41d8@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72013 https://www.cve.org/CVERecord?id=CVE-2026-72013
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent NULL pointer dereference in machine_kexec_prepare() A NULL pointer dereference issue is noticed in riscv's machine_kexec_prepare(), where image->segment[i].buf might be NULL and copied unchecked. The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without a check in machine_kexec_prepare(): kexec_file_load -> kimage_file_alloc_init() -> kimage_file_prepare_segments() -> ima_add_kexec_buffer() -> kexec_add_buffer() -> machine_kexec_prepare() -> memcpy() Address this by adding a check before the data copy attempt.
Title		riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/606cc45e871e34b80a2f63874f069387a5b44176 https://git.kernel.org/stable/c/6ad6954492697681ebcfc1beb0eb384406cd4b65 https://git.kernel.org/stable/c/81bbcff0c053c4f5c711c31a9b72fc492bd96c3f https://git.kernel.org/stable/c/b5f92cc4e24a298bf390b0b189a4b888c0900161 https://git.kernel.org/stable/c/c462e15497dc40abe369b3be7a2c91ac5d1be6f9 https://git.kernel.org/stable/c/d5b2752a17efc165793ae38f2c24b5ed9c04ffde https://git.kernel.org/stable/c/eadd0c2c76aee6a738f17f251434c77db3c606c8

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:51:41.982Z

Updated: 2026-08-17T05:06:35.378Z

Reserved: 2026-08-09T03:40:39.899Z

Link: CVE-2026-72013

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:00.033

Modified: 2026-08-17T06:17:58.763

Link: CVE-2026-72013

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72013 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T04:30:06Z

Weaknesses

CWE-476

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object