CVE-2026-23196: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23196 is a NULL pointer dereference vulnerability in the Linux kernel's Intel THC (Touch Host Controller) HID driver. The flaw occurs when the driver attempts to read a DMA (Direct Memory Access) buffer without first verifying that the buffer is ready, potentially allowing a local attacker to trigger a kernel crash. Affected versions span Linux kernel 6.14 through 6.18.9, as well as release candidates 6.19-rc1 through 6.19-rc4. It was published on February 14, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference). The Intel THC HID driver (HID: Intel-thc-hid) lacked a safety check to confirm DMA buffer readiness before attempting to read from it; under certain device interaction conditions, the buffer pointer can be NULL, causing an unexpected kernel-level dereference. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it exploitable by any local user who can interact with the Intel THC HID device. Patches were committed to the stable kernel tree addressing this missing readiness check (Kernel Patch 1, Kernel Patch 2).

Successful exploitation results in a denial of service — specifically a kernel crash or system hang — due to the NULL pointer dereference in kernel space. There is no confidentiality or integrity impact; the vulnerability is limited to availability (rated High for that dimension). Systems running affected kernel versions with Intel THC HID hardware could be rendered unstable or completely unavailable by a local low-privileged user (Feedly).

• Logs: Unexpected kernel oops or panic messages in /var/log/kern.log or dmesg output referencing the intel-thc-hid or intel_thc driver module and a NULL pointer dereference at a DMA read path.
• Process/System Behavior: Sudden system freeze or reboot on systems with Intel THC HID hardware, particularly following device interaction events.
• Kernel Crash Dumps: Crash dump files (e.g., /var/crash/) containing stack traces involving intel_thc or related HID driver functions.

Update the Linux kernel to version 6.18.10 or later, which includes the fix for this vulnerability. The patches are available in the stable kernel tree at the two referenced commits. For systems that cannot be immediately patched, restrict local user access to systems with Intel THC HID hardware and monitor for unexpected kernel crashes. Red Hat has also tracked this CVE for their affected distributions (Kernel Patch 1, Kernel Patch 2).