Kexec Buffer Initialization Issue in Linux Kernel Affecting Multiple Architectures

CVE-2025-39904

What is CVE-2025-39904?

A vulnerability has been identified in the Linux kernel related to the kexec_buf structure, which was previously declared without proper initialization. This flaw can lead to the use of uninitialized memory fields, resulting in unpredictable behavior. The issue was brought to attention after an update allowed for random placement of kexec_buf, but the new field was not guaranteed to be populated across all architectures. As a result, accessing uninitialized memory can trigger undefined behavior, such as UBSAN warnings indicating invalid loads. The importance of ensuring that all fields within the kexec_buf are zero-initialized at declaration has been emphasized to prevent future occurrences of similar issues.

References