CVE-2026-23044: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23044 is a kernel crash vulnerability in the Linux kernel's Power Management (PM) hibernate subsystem, caused by improper handling of error pointers returned by crypto_alloc_acomp(). When the function fails, it returns an ERR_PTR value rather than NULL; however, the cleanup code in save_compressed_image() and load_compressed_image() unconditionally calls crypto_free_acomp() without checking for this error pointer, leading to a null/invalid pointer dereference and kernel crash. The vulnerability was published on February 4, 2026, and affects the Linux kernel in versions between commit b03d542c3c9569f549b1ba0cf7f4d90151fbf8ab and the respective fix commits. Patches are available in Linux 6.18.6 and 6.19-rc5. The CVSS estimate is Medium severity, with an EPSS score of 0.024% (Feedly, EUVD).

The root cause is a NULL pointer dereference / improper error handling (CWE-476) in the Linux kernel's hibernate compression path. crypto_alloc_acomp() returns an ERR_PTR on failure (e.g., when CONFIG_CRYPTO_LZO is not enabled in the kernel build), but the cleanup routines save_compressed_image() and load_compressed_image() pass this invalid pointer directly to crypto_free_acomp() and acomp_request_free() without an IS_ERR_OR_NULL() guard. This causes crypto_acomp_tfm() to dereference the invalid pointer, crashing the kernel. The fix adds IS_ERR_OR_NULL() checks before these cleanup calls, consistent with the existing pattern used for kthread_stop() in the same code (Feedly, EUVD).

Successful triggering of this vulnerability results in a kernel panic (crash), causing a complete loss of availability for the affected system. The impact is limited to denial of service — there is no evidence of code execution, privilege escalation, or data exfiltration potential. The vulnerability is triggered during hibernate operations when a compression algorithm (e.g., LZO) is unavailable, meaning only systems that attempt hibernation with an unsupported or unconfigured crypto compressor are at risk (Feedly).

Apply the upstream Linux kernel patches available in stable commits b7a883b0135dbc6817e90a829421c9fc8cd94bad and 7966cf0ebe32c981bfa3db252cb5fc3bb1bf2e77, included in Linux 6.18.6 and 6.19-rc5. As a workaround, administrators can ensure that the required crypto compression algorithm (e.g., CONFIG_CRYPTO_LZO) is enabled in the kernel configuration, or disable hibernate functionality on affected systems until a patched kernel is deployed (EUVD, Feedly).