CVE-2026-19411: 
Linux Red Hat 脆弱性の分析と軽減

CVE-2026-19411 is a NULL Pointer Dereference vulnerability (CWE-476) found in the dp.c library of the shim UEFI bootloader application. A missing NULL pointer check in the is_removable_media_path() function can allow a local attacker with high privileges to trigger a denial of service condition on affected systems. The vulnerability was disclosed on August 10, 2026, and affects Red Hat products including shim-signed and shim-unsigned-aarch64. It carries a CVSS v3.1 base score of 3.9 (Low/Medium) (Red Hat CVE, GitHub Advisory).

The root cause is a missing NULL pointer check in the is_removable_media_path() function within the shim dp.c library (CWE-476). When DevicePathToStr() returns NULL — for example, due to an EFI pool-allocation failure — the result is passed directly to StrnCaseCmp(), which dereferences the NULL pointer on its first loop iteration and crashes the process. Exploitation requires local access and high privileges, making this primarily a robustness/defensive-hardening issue rather than an attacker-controlled memory-safety bug. Red Hat's advisory specifies the fix involves adding NULL checks before DevicePathToStr and after its return value is used (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation can cause the shim UEFI bootloader to crash or hang, resulting in system unavailability (denial of service). In rare circumstances, the vulnerability could also allow minor integrity impact through memory modification, as noted by Red Hat's CWE-476 analysis. The scope is marked as "Changed," meaning the impact can extend beyond the vulnerable component itself, potentially affecting the broader boot process. Confidentiality impact is assessed as none (Red Hat CVE).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with high privileges and high attack complexity, significantly limiting the practical attack surface (GitHub Advisory, Red Hat CVE).

Red Hat has provided a patch tracked via Bugzilla bug 2513060. The code-level fix involves adding NULL pointer checks in dp.c: before calling DevicePathToStr, add if (li == NULL || li->FilePath == NULL) return 0;; after the call, add if (bootpath == NULL) return 0;; and at the error path, guard with if (bootpath != NULL). Until a patched package is available, administrators should restrict local access and limit high-privilege account usage on systems running vulnerable shim versions, and monitor UEFI bootloader logs for abnormal termination or crash events (Red Hat CVE, Red Hat Bugzilla).

Red Hat rates this vulnerability as Moderate impact, noting that while it does not guarantee consistent behavior across all use cases, it could make systems unstable and allow local denial of service or minor integrity/availability corruption. The GitHub Advisory Database classifies it as Low severity. No significant broader media coverage or notable researcher commentary has been identified beyond the initial vendor disclosure (Red Hat CVE, GitHub Advisory).