CVE-2026-23285: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23285 is a null-pointer dereference vulnerability in the Linux kernel's DRBD (Distributed Replicated Block Device) driver that can allow a local attacker to cause a kernel panic and denial of service. The flaw exists in the drbd_request_endio() function, where READ_COMPLETED_WITH_ERROR is passed to __req_mod() with a NULL peer_device, which is then unconditionally dereferenced in drbd_set_out_of_sync(). Affected Linux kernel versions include 6.4–6.6.130, 6.7–6.12.77, 6.13–6.18.17, 6.19–6.19.7, and 7.0-rc1. The vulnerability was published on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is a NULL Pointer Dereference (CWE-476) in the DRBD driver's I/O error handling path. In drbd_request_endio(), when a local read error occurs, READ_COMPLETED_WITH_ERROR is dispatched to __req_mod() with an explicitly passed NULL peer_device. The handler for this event then calls drbd_set_out_of_sync() without validating the pointer, causing a kernel crash. The fix resolves this by obtaining the peer_device via first_peer_device(device) before the call, consistent with how drbd_req_destroy() handles the same scenario (Red Hat CVE, kernel.org patch). Exploitation requires local access and the ability to trigger a read error on a DRBD-configured block device.

Successful exploitation causes a kernel panic, resulting in a complete denial of service for the affected system, which may require a reboot to recover. The impact is limited to availability — there is no confidentiality or integrity impact. Systems using DRBD for distributed storage replication are at risk, and a crash could disrupt replicated storage services and any workloads depending on them (Red Hat CVE, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term (Feedly). Exploitation requires local access with low privileges on a system running a vulnerable kernel with DRBD configured.

Update the Linux kernel to a patched version: 6.6.130, 6.12.77, 6.18.17, 6.19.7, or 7.0-rc2 (or later). Patches are available via the upstream kernel stable tree and have been incorporated into distributions including Amazon Linux 2023 and Debian. As an interim measure, restrict local access to systems with DRBD devices configured until the patch can be applied (Red Hat CVE, Amazon Linux Advisory, kernel.org patch).