CVE-2026-23187: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23187 is an out-of-bounds read vulnerability in the Linux kernel's pmdomain subsystem, specifically in the imx8m-blk-ctrl driver. The flaw occurs in the imx8m_blk_ctrl_remove() function due to an out-of-range access of the bc->domains array. It was published on February 14, 2026, and affects Linux kernel versions from 5.16 up to (but not including) 6.1.163, 6.2–6.6.124, 6.7–6.12.70, and 6.13–6.18.10, as well as release candidates 6.19-rc1 through 6.19-rc8. The CVSS v3.1 base score is 7.1 (High) (Feedly).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and stems from improper bounds checking when accessing the bc->domains array during device removal in the imx8m_blk_ctrl_remove() function of the pmdomain/imx8m-blk-ctrl kernel driver (Feedly). The attack vector is local, requiring low privileges and no user interaction, making it exploitable by any unprivileged local user on an affected system. Five upstream kernel commits were issued to address the flaw across multiple stable branches (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).

A local attacker with low privileges can exploit this vulnerability to read sensitive kernel memory contents, potentially disclosing confidential data, and to trigger a denial of service through system crashes or hangs. The confidentiality and availability impacts are both rated High, while integrity is unaffected. The scope is limited to the local system; however, kernel memory disclosure could facilitate further privilege escalation or lateral movement in multi-tenant environments (Feedly).

Apply the appropriate patched Linux kernel version based on your current branch: upgrade to 6.1.163 or later (for 5.16–6.1.x), 6.6.124 or later (for 6.2–6.6.x), 6.12.70 or later (for 6.7–6.12.x), or 6.18.10 or later (for 6.13+) (Feedly). Debian, SUSE, and Ubuntu have all issued distribution-specific kernel updates addressing this CVE (Debian LTS Announce, SUSE Advisory). As a temporary workaround where patching is not immediately possible, restrict local user access to affected systems and monitor for suspicious kernel module loading or unloading activity.

Multiple Linux distributions including Debian, SUSE, and Ubuntu have issued security advisories and updated kernel packages addressing CVE-2026-23187 (Debian LTS Announce, SUSE Advisory, Ubuntu Advisory). The vulnerability was also covered by Linux security news aggregators and the OpenSUSE security mailing list. No notable independent researcher commentary or significant social media discussion has been identified beyond routine patch tracking.