{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.18.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  kernel/kexec: fix IMA when allocation happens in CMA area  *** Bug description ***  When I tested kexec with the latest kernel, I ran into the following warning:  [   40.712410] ------------[ cut here ]------------ [   40.712576] WARNING: CPU: 2 PID: 1562 at kernel/kexec_core.c:1001 kimage_map_segment+0x144/0x198 [...] [   40.816047] Call trace: [   40.818498]  kimage_map_segment+0x144/0x198 (P) [   40.823221]  ima_kexec_post_load+0x58/0xc0 [   40.827246]  __do_sys_kexec_file_load+0x29c/0x368 [...] [   40.855423] ---[ end trace 0000000000000000 ]---  *** How to reproduce ***  This bug is only triggered when the kexec target address is allocated in the CMA area. If no CMA area is reserved in the kernel, use the \"cma=\" option in the kernel command line to reserve one.  *** Root cause *** The commit 07d24902977e (\"kexec: enable CMA based contiguous allocation\") allocates the kexec target address directly on the CMA area to avoid copying during the jump. In this case, there is no IND_SOURCE for the kexec segment.  But the current implementation of kimage_map_segment() assumes that IND_SOURCE pages exist and map them into a contiguous virtual address by vmap().  *** Solution *** If IMA segment is allocated in the CMA area, use its page_address() directly.",
  "id": "DEBIAN-CVE-2025-71139",
  "modified": "2026-09-01T19:48:26.833905452Z",
  "published": "2026-01-14T15:16:03.693Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2025-71139"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2025-71139"
  ]
}