IGEL OS 12 / 11 Boot Registry Parameter Injection via Unsigned Configuration Area
IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader. Attackers can inject malicious kernel command line parameters that execute with boot environment privileges without triggering TPM PCR measurement failures, as the attack does not modify the measured boot code.
CVE-2026-82017
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-82017
IGEL OS 12
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
IGEL OS 11
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "IGEL",
"product": "IGEL OS 12",
"versions": [
{
"status": "affected",
"version": "12.0.0",
"lessThan": "12.7.6",
"versionType": "semver"
}
],
"defaultStatus": "affected"
},
{
"vendor": "IGEL",
"product": "IGEL OS 11",
"versions": [
{
"status": "affected",
"version": "11.0.0",
"lessThan": "11.11.150",
"versionType": "semver"
}
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-82017
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #5569 · Revision 1
- Added to Heist Feed
- Publisher date