2 files changed, 8 insertions, 0 deletions
diff --git a/src/kernel/KernelKit/PE.h b/src/kernel/KernelKit/PE.h
index 751e7ceb..bef39481 100644
--- a/src/kernel/KernelKit/PE.h
+++ b/src/kernel/KernelKit/PE.h
@@ -15,6 +15,8 @@
 #define kPeMachineAMD64 (0x8664)
 #define kPeMachineARM64 (0xaa64)
 
+#define kNeKernelPESubsystem (0x11)
+
 typedef struct LDR_EXEC_HEADER final {
   Kernel::UInt32 Signature;
   Kernel::UInt16 Machine;
diff --git a/src/kernel/src/PE32CodeMgr.cc b/src/kernel/src/PE32CodeMgr.cc
index 517900c4..7f5250fd 100644
--- a/src/kernel/src/PE32CodeMgr.cc
+++ b/src/kernel/src/PE32CodeMgr.cc
@@ -98,6 +98,12 @@ ErrorOr<VoidPtr> PE32Loader::FindSectionByName(const Char* name) {
     return ErrorOr<VoidPtr>{kErrorInvalidData};
   }
 
+#if !defined(__nekernel_allow_non_nekernel_pe)
+  if (opt_header_ptr->Subsystem != kNeKernelPESubsystem) {
+    return ErrorOr<VoidPtr>{kErrorInvalidData};
+  }
+#endif
+
   LDR_SECTION_HEADER_PTR secs =
       (LDR_SECTION_HEADER_PTR) (((Char*) opt_header_ptr) + header_ptr->SizeOfOptionalHeader);