CVE-2026-82017

HighCVSS 7.6

Published: 28/08/2026(UTC)Translated: 29/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

Vulnerability in IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150. An attacker with physical access can inject Linux loader parameters by writing to an unencrypted and unsigned configuration area, allowing execution of malicious kernel parameters with boot environment privileges without triggering TPM PCR failures.

Risk Assessment

Risk of system compromise by an attacker with physical access, bypassing TPM protections.

Recommendation

Upgrade IGEL OS to version 12.7.6 or 11.11.150. Restrict physical access to devices.

Other vulnerabilities in IGEL OS

CVE-2026-82018Medium
IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit GRUB's fail-open signature verification behavior to drop into an interactive GRUB prompt, then boot the device's own kernel with additional command-line arguments to obtain a root shell with the disk unlocked while leaving TPM PCR values unaltered.

Original NVD description (English source)

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader. Attackers can inject malicious kernel command line parameters that execute with boot environment privileges without triggering TPM PCR measurement failures, as the attack does not modify the measured boot code.