CVE-2026-23369: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23369 is a race condition vulnerability in the Linux kernel's i2c-i801 driver ACPI handler that can cause a NULL pointer dereference and kernel panic during system boot. The flaw was introduced by commit f707d6b9e7c18f669adfdb443906d46cfbaaa0c1 ("i2c: i801: replace acpi_lock with I2C bus lock") and is resolved by reverting that commit. Affected Linux kernel versions include 6.7, 6.7.1 through 6.12.76, 6.13 through 6.18.16, 6.19 through 6.19.6, and 7.0 RC1 through RC7. It was disclosed on March 25, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use Race Condition) and CWE-476 (NULL Pointer Dereference). Under rare boot-time conditions, multiple systemd-udevd threads can concurrently execute i801_acpi_io_handler: the first thread causes the ACPI-reserved memory region to be deregistered, while a second thread enters the handler after deregistration but before a validity check can occur. The second thread then calls i2c_lock_bus, which dereferences lock_ops from the now-unregistered (and zeroed) memory area, resulting in a NULL pointer dereference and kernel panic. The attack vector is local and requires low privileges, as the race is triggered by normal hardware enumeration activity during boot rather than by deliberate attacker input (Red Hat Bugzilla, Red Hat Advisory).

Successful triggering of this vulnerability results in a kernel panic (BUG: kernel NULL pointer dereference) during system boot, rendering the affected system completely unavailable until a patched kernel is installed. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. The race condition is hardware-dependent and timing-sensitive, meaning it manifests inconsistently across systems with i801 I2C controllers and specific ACPI configurations (Red Hat Bugzilla, Red Hat Advisory).

• Logs: Kernel log entries containing BUG: kernel NULL pointer dereference, address: 0000000000000000 during boot; stack traces referencing i801_acpi_io_handler+0x2d/0xb0 [i2c_i801] and acpi_ev_address_space_dispatch.
• System Behavior: System fails to complete boot process and drops into a kernel panic or emergency shell; repeated boot failures on systems with Intel i801 I2C/SMBus controllers.
• Process: systemd-udevd processes (PID in the 900s range during boot) associated with the crash, as seen in the backtrace Comm: systemd-udevd (Red Hat Bugzilla).

Update the Linux kernel to a patched version: 6.12.77 or later for the 6.12.x series, 6.18.17 or later for the 6.18.x series, or 6.19.7 or later for the 6.19.x series. Patches are available via upstream kernel stable commits on git.kernel.org and through distribution advisories including Red Hat and Amazon Linux 2023 (ALAS2023-2026-1543, ALAS2023-2026-1596). Verify the current kernel version with uname -r and apply the appropriate update through the distribution's package manager. No configuration-based workaround is available; upgrading the kernel is the only remediation (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability was reported via the upstream Linux kernel CVE announcement list (lore.kernel.org/linux-cve-announce) and tracked by Red Hat's Product Security team. Detection plugins were released by Tenable (Nessus plugin IDs 303709, 305231, 311340) and Qualys (detection IDs 362111, 762889), indicating standard industry uptake for patch verification. No notable public researcher commentary or significant social media discussion has been observed beyond routine vulnerability tracking (Red Hat Bugzilla).