CVE-2026-23156

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23156
In the Linux kernel, the following vulnerability has been resolved: efivarfs: fix error propagation in efivar_entry_get() efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors. This may result in uninitialized heap memory being copied to userspace in the efivarfs_file_read() path. Fix it by returning the error from __efivar_entry_get().

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3960f1754664661a970dc9ebbab44ff93a0b4c42 Patch
https://git.kernel.org/stable/c/4b22ec1685ce1fc0d862dcda3225d852fb107995 Patch
https://git.kernel.org/stable/c/510a16f1c5c1690b33504052bc13fbc2772c23f8 Patch
https://git.kernel.org/stable/c/89b8ca709eeeabcc11ebba64806677873a2787a8 Patch
https://git.kernel.org/stable/c/e4e15a0a4403c96d9898d8398f0640421df9cb16 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
History

18 Mar 2026, 14:40

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/3960f1754664661a970dc9ebbab44ff93a0b4c42 - () https://git.kernel.org/stable/c/3960f1754664661a970dc9ebbab44ff93a0b4c42 - Patch
References () https://git.kernel.org/stable/c/4b22ec1685ce1fc0d862dcda3225d852fb107995 - () https://git.kernel.org/stable/c/4b22ec1685ce1fc0d862dcda3225d852fb107995 - Patch
References () https://git.kernel.org/stable/c/510a16f1c5c1690b33504052bc13fbc2772c23f8 - () https://git.kernel.org/stable/c/510a16f1c5c1690b33504052bc13fbc2772c23f8 - Patch
References () https://git.kernel.org/stable/c/89b8ca709eeeabcc11ebba64806677873a2787a8 - () https://git.kernel.org/stable/c/89b8ca709eeeabcc11ebba64806677873a2787a8 - Patch
References () https://git.kernel.org/stable/c/e4e15a0a4403c96d9898d8398f0640421df9cb16 - () https://git.kernel.org/stable/c/e4e15a0a4403c96d9898d8398f0640421df9cb16 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
First Time Linux
Linux linux Kernel

18 Feb 2026, 17:52

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: efivarfs: corrección de la propagación de errores en efivar_entry_get() efivar_entry_get() siempre devuelve éxito incluso si la función subyacente __efivar_entry_get() falla, enmascarando errores. Esto puede resultar en que memoria de pila no inicializada sea copiada al espacio de usuario en la ruta de efivarfs_file_read(). Se soluciona devolviendo el error desde __efivar_entry_get().

14 Feb 2026, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-14 16:15

Updated : 2026-03-18 14:40

NVD link : CVE-2026-23156

Mitre link : CVE-2026-23156

CVE.ORG link : CVE-2026-23156

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo