CVE-2026-23128: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23128 is a Control Flow Integrity (CFI) verification mismatch vulnerability in the ARM64 Linux kernel's hibernation resume functionality. The swsusp_arch_resume() function attempts to verify a CFI hash when calling a copy of swsusp_arch_suspend_exit(), but the latter is marked with SYM_CODE_*() macros and therefore lacks a CFI hash, triggering a kernel panic (Data Abort) during hibernation resume. It was published on February 14, 2026, and affects Linux kernel versions 6.1 through 6.1.161, 6.2 through 6.6.121, 6.7 through 6.12.67, 6.13 through 6.18.7, and 6.19-rc1 through rc6. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a CFI (Control Flow Integrity) enforcement mismatch (CWE-691: Insufficient Control Flow Management) in the ARM64 architecture's suspend/resume code path. swsusp_arch_suspend_exit() is defined using SYM_CODE_*() assembly macros, which do not generate a CFI hash, while swsusp_arch_resume() — a regular C function with CFI enabled — attempts to call a relocated copy of swsusp_arch_suspend_exit() and triggers a CFI hash verification that fails. This results in a Data Abort (DABT) at the kernel level with ESR 0x0000000096000007 (level 3 translation fault), crashing the system with "Unable to handle kernel paging request." The fix marks swsusp_arch_resume() with __nocfi to disable the CFI check for that function, as the entry point constraint for swsusp_arch_suspend_exit() (it must be the first byte of .hibernate_exit.text) prevents reclassification with SYM_FUNC_*() (Feedly, kernel.org patch).

Exploitation of this vulnerability causes a kernel panic during hibernation resume on affected ARM64 systems, rendering the hibernation (suspend-to-disk) feature completely unusable. The availability impact is high — the system crashes and cannot successfully resume from hibernation — while there is no confidentiality or integrity impact. This particularly affects Android-based ARM64 devices and embedded systems that rely on hibernation, such as those using NVIDIA Tegra or Xilinx Zynq MP SoCs (Feedly, Ubuntu USN-8162-1).

Upgrade to a patched Linux kernel version: 6.1.162 or later, 6.6.122 or later, 6.12.68 or later, or 6.18.8 or later. Patches are available via kernel.org stable branches with commit references 122b7cb80f7d, 6e32070d29d1, 8557bdd9af8d, 9773a886f267, and e2f8216ca2d8. Ubuntu has issued multiple security notices (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1) addressing this issue. As a temporary workaround for systems that cannot be immediately patched, disabling hibernation/suspend-to-disk functionality will prevent the crash; this issue is specific to ARM64 and does not affect x86 or other architectures (Feedly, Ubuntu USN-8180-1).

The vulnerability received routine coverage from Linux security tracking outlets including linuxsecurity.com and pro-linux.de, primarily in the context of Ubuntu and Oracle Linux kernel update advisories. No notable independent researcher commentary or significant social media discussion has been identified beyond standard CVE tracking and vendor patch notifications (Feedly).