Answer in brief
CVE-2026-68435 records a Unknown severity vulnerability in LoongArch: Fix address space mismatch in kexec command line lookup. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 <a94d6726ec8680a2b0c453fc782a543f68a1ea06 || >=4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 <7a54e0cbaad4a5a09e7cc7a4f05d181048e98ca7 || >=4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 <485ed44db5694d8d2e5027f63ad608e705286f30 | a94d6726ec8680a2b0c453fc782a543f68a1ea06, 7a54e0cbaad4a5a09e7cc7a4f05d181048e98ca7, 485ed44db5694d8d2e5027f63ad608e705286f30 |
| Linux/Linuxgeneric | 6.1 | Not reported |
Published upstream
Aug 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 12, 2026
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexec_load(2) path (file_mode == 0) passes the user-space segment buffer straight to strncmp() through a bogus (char __user *) cast. This dereferences a user pointer in kernel context, which is wrong and is flagged by sparse: arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in argument 2 (different address spaces) @@ expected char const * @@ got char [noderef] __user * Here copy the marker-sized prefix of each segment into a small on-stack buffer with copy_from_user() before comparing, and skip segments that fault. The subsequent copy_from_user() that stages the full command line into the safe area is left unchanged.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-68435 records a Unknown severity vulnerability in LoongArch: Fix address space mismatch in kexec command line lookup. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 <a94d6726ec8680a2b0c453fc782a543f68a1ea06 || >=4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 <7a54e0cbaad4a5a09e7cc7a4f05d181048e98ca7 || >=4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 <485ed44db5694d8d2e5027f63ad608e705286f30 | a94d6726ec8680a2b0c453fc782a543f68a1ea06, 7a54e0cbaad4a5a09e7cc7a4f05d181048e98ca7, 485ed44db5694d8d2e5027f63ad608e705286f30 |
| Linux/Linuxgeneric | 6.1 | Not reported |
Published upstream
Aug 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 12, 2026
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexec_load(2) path (file_mode == 0) passes the user-space segment buffer straight to strncmp() through a bogus (char __user *) cast. This dereferences a user pointer in kernel context, which is wrong and is flagged by sparse: arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in argument 2 (different address spaces) @@ expected char const * @@ got char [noderef] __user * Here copy the marker-sized prefix of each segment into a small on-stack buffer with copy_from_user() before comparing, and skip segments that fault. The subsequent copy_from_user() that stages the full command line into the safe area is left unchanged.
Quoted source text, attributed separately from HOL analysis.