CVE-2026-23002: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23002 is a NULL pointer dereference vulnerability in the Linux kernel's lib/buildid component that causes a kernel crash when reading file cache pages in sleepable contexts. The flaw arises because the freader code used read_cache_folio() for direct page cache access in sleepable contexts, which could trigger a "BUG: unable to handle kernel NULL pointer dereference in filemap_read_folio". Affected versions include Linux kernel 6.12 (base), 6.12.1 through 6.12.66, 6.13 through 6.18.6, and 6.19-rc1 through rc8. It was published on January 25, 2026, with NVD initial analysis completed March 25, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in lib/buildid when the kernel's freader uses read_cache_folio() for direct page cache access in a sleepable execution context. When the required folio is not already present in the page cache, filemap_read_folio can be called with a NULL pointer, triggering a kernel BUG. The fix converts the sleepable code path to use __kernel_read(), the standard kernel file reading interface that properly handles all complexity of reading file data including page faults. The non-sleepable path (using filemap_get_folio()) was intentionally left unchanged to keep the patch minimal and backport-friendly. The bug was discovered and reproduced via Syzbot (Red Hat Bugzilla).

Successful exploitation results in a kernel NULL pointer dereference that crashes the affected system, causing a denial of service (DoS). There is no confidentiality or integrity impact — only availability is affected, with a HIGH availability impact rating. An attacker with low-privileged local access can trigger this condition without any user interaction, potentially disrupting all services running on the affected host (Red Hat Advisory).

The vulnerability is resolved in Linux kernel versions 6.12.67 and later, and 6.18.7 and later. Three patch commits are available at kernel.org: 568aeb3476c770a3863c755dd2a199c212434286, 777a8560fd29738350c5094d4166fe5499452409, and b11dfb7708f212b96c7973a474014c071aa02e05. Administrators should upgrade affected systems to a patched kernel version as the primary remediation. As a temporary measure, restricting local user access can reduce the attack surface until patching is feasible (Red Hat Advisory, Red Hat Bugzilla).