CVE-2026-23199: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23199 is a deadlock vulnerability in the Linux kernel's procfs subsystem, classified as Improper Locking (CWE-667). It arises when the PROCMAP_QUERY ioctl attempts to fetch optional build ID information while still holding the mmap_lock or per-VMA lock, creating a circular lock dependency with filesystem inode locks. Affected versions include Linux kernel 6.11 through 6.12.69, 6.13 through 6.18.9, and 6.19-rc1 through 6.19-rc8. The vulnerability was published on February 14, 2026, with patches released on March 19, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper lock ordering (CWE-667) in the do_procmap_query() function within the Linux kernel's procfs implementation. When handling a PROCMAP_QUERY ioctl, the function calls __build_id_parse() to retrieve ELF build ID metadata while still holding the VMA lock (mmap_lock). This internally triggers a filesystem read via blkdev_read_iter → filemap_read → _copy_to_iter, which attempts to acquire the filesystem inode lock (sb->s_type->i_mutex_key). A concurrent thread holding the inode lock and waiting on mmap_lock creates a classic ABBA deadlock. The fix defers build ID fetching until after VMA locks are released and introduces a new build_id_parse_file() API that accepts file references directly (Feedly, Kernel Patch 1).

A local attacker with low privileges can trigger a kernel deadlock by invoking the PROCMAP_QUERY ioctl on a procfs file descriptor, causing affected processes or threads to hang indefinitely. The deadlock can render the system unresponsive and may necessitate a reboot, resulting in a high availability impact. There is no confidentiality or integrity impact, as the vulnerability does not expose data or allow unauthorized writes (Feedly).

1. Gain local access: Obtain a low-privileged local user account on a system running a vulnerable Linux kernel version (6.11–6.12.69, 6.13–6.18.9, or 6.19-rc1 through rc8).
2. Open a procfs file descriptor: Open a file descriptor to a target process's memory map entry via /proc/<pid>/maps or a related procfs interface that supports the PROCMAP_QUERY ioctl.
3. Trigger concurrent lock contention: Arrange for a second thread or process to hold the filesystem inode lock (e.g., by performing a blocking read on a block device) concurrently.
4. Issue PROCMAP_QUERY ioctl: Call the PROCMAP_QUERY ioctl with a request that includes build ID fetching enabled. The kernel will attempt to parse the ELF build ID while holding the VMA lock, triggering the circular lock dependency.
5. Deadlock achieved: The kernel enters a deadlock state — the calling thread hangs indefinitely waiting on the inode lock, while the other thread waits on mmap_lock, causing system instability or requiring a reboot (Feedly).

• Logs: Kernel logs (dmesg) showing lock dependency warnings or deadlock traces involving mmap_lock and sb->s_type->i_mutex_key; syzbot-style lockdep reports referencing do_procmap_query, blkdev_read_iter, or __build_id_parse.
• Process Behavior: Processes or threads stuck in uninterruptible sleep (D state in ps output) associated with procfs ioctl calls; system becoming unresponsive without clear cause.
• System Events: Unexpected system reboots or kernel panics on systems running affected kernel versions, particularly on hosts where procfs PROCMAP_QUERY is actively used by profiling or debugging tools.

Update the Linux kernel to a patched version: 6.12.70 or later, or 6.18.10 or later. Three upstream commits address the issue: b5cbacd7f86f, b9b97e6aeb53, and cbc03ce3e6ce. Downstream distributions including Debian and Oracle Linux have issued updated kernel packages incorporating these fixes. As a temporary workaround, restricting access to procfs ioctl operations via access controls (e.g., limiting which users can call PROCMAP_QUERY) can reduce exposure, though upgrading is the recommended solution (Feedly, Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).

The vulnerability was detected and reported by syzbot, the Linux kernel's automated fuzzing system, which generated the deadlock trace included in the CVE description. Downstream Linux distributions including Debian and Oracle Linux have issued security advisories and updated kernel packages. No notable independent researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking (Feedly).