CVE-2026-23474: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23474 is a buffer over-read vulnerability in the Linux kernel's MTD (Memory Technology Device) RedBoot partition table parser that can cause a kernel crash (oops) during boot. When CONFIG_FORTIFY_SOURCE is enabled with a sufficiently recent compiler (leveraging __builtin_dynamic_object_size()), the memcmp() call in the partition name comparison reads up to 15 bytes from a buffer allocated for only 14 bytes, triggering a fortify warning and system crash. The vulnerability affects Linux kernel versions from 2.6.12 through multiple stable branches up to 6.19. It was published on April 3, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is an out-of-bounds read (CWE-125) in the RedBoot partition table parser (drivers/mtd/redboot.c). The names pointer references the final namelen bytes of a dynamically allocated buffer, and the subsequent memcmp() call uses a hardcoded length that can exceed the actual allocation size — as confirmed by kernel security reviewer Kees Cook. Because the dynamic allocation size is derived from strlen(), replacing memcmp() with strcmp() is sufficient to stay within bounds. The bug is exposed only when CONFIG_FORTIFY_SOURCE=y is combined with a compiler that supports __builtin_dynamic_object_size(), which enables runtime buffer-size tracking (GitHub Advisory).

Successful triggering of this vulnerability results in a kernel oops during boot or whenever the RedBoot partition table parser is invoked, causing a denial of service (system crash/unavailability). There is no confidentiality or integrity impact — the vulnerability is limited to availability. Systems using MTD flash devices with RedBoot partition tables and compiled with CONFIG_FORTIFY_SOURCE are at risk, which is most relevant to embedded Linux platforms and network appliances (Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of writing. The vulnerability requires local access with low privileges and is only triggerable on systems with specific hardware (MTD flash with RedBoot partition tables) and kernel build configuration (CONFIG_FORTIFY_SOURCE=y). The EPSS score is approximately 0.03%, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

Patches are available for all major stable kernel branches. Administrators should upgrade to one of the following fixed versions: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, or later. SUSE has issued security advisories (SUSE-SU-2026:2217-1 and SUSE-SU-2026:2238-1) and Debian has accepted the fix into its security repositories. As a temporary workaround, disabling CONFIG_FORTIFY_SOURCE at compile time will prevent the crash, but this is not recommended as it removes other important security protections. The preferred fix is replacing memcmp() with strcmp() in the RedBoot parser, which is included in all upstream patches (GitHub Advisory, SUSE Advisory, Debian Tracker).

Kernel security reviewer Kees Cook confirmed the legitimacy of the fortify warning, noting that the code was previously reading beyond the end of the allocation. The fix was straightforward and accepted upstream without controversy. Yocto Project security mailing lists discussed the issue across multiple messages, and both SUSE and Debian issued timely security updates (Yocto Security List, SUSE Advisory).