CVE-2026-72013

A flaw was found in the Linux kernel. Specifically, within the riscv architecture's machine_kexec_prepare() function, a NULL pointer dereference can occur. This vulnerability arises when a NULL buffer is copied without proper validation during the kexec preparation process. An attacker could potentially exploit this to cause a system crash, leading to a denial of service.

This vulnerability is rated as having a Moderate impact because exploitation is confined to local authenticated contexts requiring kexec privileges to trigger a kernel crash, without enabling code execution or data exposure. In Red Hat environments, the flaw is confined to the RISC-V hardware architecture, which is not supported across Red Hat Enterprise Linux releases. As a result, standard enterprise deployments do not contain the vulnerable kernel code path and are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.