CVE-2026-23222: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23222 is a heap buffer overflow vulnerability in the Linux kernel's OMAP crypto driver (crypto: omap) caused by an incorrect scatterlist memory allocation in omap_crypto_copy_sg_lists(). The function allocates an array of scatterlist pointers rather than scatterlist objects, resulting in a buffer that is approximately 4x too small. It was published on February 18, 2026, and affects Linux kernel versions from 4.13 through multiple stable branches up to 6.19.0, as well as Microsoft's Azure Linux kernels (CBL2 5.15.200.1-1 and AZL3 6.6.121.1-1). It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC, Red Hat).

The root cause is a heap buffer overflow (CWE-122) in omap_crypto_copy_sg_lists() within the Linux kernel's OMAP crypto driver. The allocation uses sizeof(pointer) (typically 8 bytes on 64-bit systems) instead of sizeof(*new_sg) (the size of a full struct scatterlist object, typically 32–64 bytes), resulting in a buffer roughly 4x undersized. When the function subsequently writes scatterlist data into this buffer, it overflows into adjacent heap memory. Exploitation requires local user-level access to a system with the OMAP crypto driver loaded; no network access or special privileges beyond a standard user account are needed (Feedly, Red Hat).

Successful exploitation allows a local attacker with low privileges to corrupt kernel heap memory, potentially leading to privilege escalation to kernel level, arbitrary kernel code execution, or system crash (denial of service). There is no direct confidentiality or integrity impact from the allocation bug itself, but heap corruption can be leveraged to read or write kernel memory without authorization, enabling complete system compromise. The availability impact is rated High, as kernel memory corruption can readily cause kernel panics or system instability (Feedly, Red Hat).

Patches have been released across multiple Linux kernel stable branches. Administrators should update to the following fixed versions: 5.10.251+, 5.15.201+, 6.1.164+, 6.6.125+, 6.12.72+, 6.18.11+, or 6.19.1+. Debian has issued security advisories (DSA-6163-1 and DLA-4499-1) and accepted the fixed kernel packages into its security repositories. Microsoft has published updates for its Azure Linux kernels (CBL2 and AZL3). As a temporary workaround where patching is not immediately possible, restrict local user access to affected systems and consider unloading or blacklisting the omap-crypto kernel module if it is not required (Feedly, Microsoft MSRC, Debian LTS).

The vulnerability received standard coverage from Linux distribution security channels, including Debian security advisories and Yocto Project security mailing lists. Microsoft acknowledged the issue through its MSRC portal for Azure Linux kernels. No notable independent researcher commentary or significant social media discussion has been observed beyond routine vulnerability database entries (Microsoft MSRC, Debian LTS).