CVE-2026-23156: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23156 is a Linux kernel vulnerability in the efivarfs subsystem where efivar_entry_get() fails to propagate errors from the underlying __efivar_entry_get() function, causing uninitialized heap memory to be copied to userspace. It was published on February 14, 2026, and affects Linux kernel versions 6.0.x through 6.1.161, 6.2.x through 6.6.122, 6.7.x through 6.12.68, 6.13.x through 6.18.8, and 6.19-rc1 through rc7. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Feedly).

The root cause is an improper error handling flaw (CWE-390 / error condition not checked) in the Linux kernel's efivarfs subsystem. Specifically, efivar_entry_get() always returns success regardless of whether the underlying __efivar_entry_get() call fails, masking errors in the efivarfs_file_read() code path. This results in uninitialized heap memory being returned to userspace when a local, low-privileged user reads from an efivarfs file and the underlying EFI variable retrieval fails. The fix, applied across multiple stable branches, simply propagates the return value of __efivar_entry_get() correctly (Feedly, Kernel Patch).

A local attacker with low privileges could exploit this vulnerability to read uninitialized kernel heap memory via the efivarfs filesystem, potentially exposing sensitive kernel data such as cryptographic material, credentials, or other in-memory secrets. The CVSS score reflects high confidentiality, integrity, and availability impact, though the primary practical risk is information disclosure of kernel heap contents. Exploitation is limited to systems where efivarfs is mounted and accessible to unprivileged users, which is common on UEFI-based Linux systems (Feedly).

Update to the following patched kernel versions: 6.1.162 or later (for the 6.0–6.1 series), 6.6.123 or later (for the 6.2–6.6 series), 6.12.69 or later (for the 6.7–6.12 series), or 6.18.9 or later (for the 6.13–6.18 series). Patches are available via upstream kernel stable commits: 3960f175, 4b22ec16, 510a16f1, 89b8ca70, and e4e15a0a (Kernel Patch). As a workaround, restrict local user access to the efivarfs mount point (typically /sys/firmware/efi/efivars) using filesystem permissions or by unmounting efivarfs on systems where it is not required. Apply updates through your Linux distribution's official update channels (Red Hat, Oracle Linux, AlmaLinux, Ubuntu, and others have issued advisories) (Red Hat Advisory, Red Hat Advisory 2).

Red Hat issued security errata (RHSA-2026:4012 and RHSA-2026:9095) addressing this vulnerability, and Oracle Linux, AlmaLinux, and Ubuntu have also released updated kernel packages (Red Hat Advisory, Red Hat Advisory 2). The Yocto Project security mailing list also flagged the issue for embedded Linux maintainers. No notable independent researcher commentary or significant social media discussion has been observed beyond routine distribution-level patch tracking.