CVE-2026-23123

Severity
5.5MEDIUM
EPSS
0.0%
top 97.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedFeb 14

Description

In the Linux kernel, the following vulnerability has been resolved: interconnect: debugfs: initialize src_node and dst_node to empty strings The debugfs_create_str() API assumes that the string pointer is either NULL or points to valid kmalloc() memory. Leaving the pointer uninitialized can cause problems. Initialize src_node and dst_node to empty strings before creating the debugfs entries to guarantee that reads and writes are safe.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

NVDlinux/linux_kernel6.66.6.122+3
CVEListV5linux/linux770c69f037c18cfaa37c3d6c6ef8bd257635513faa79a5a959c7c414bd6fba01ea8dbaddd44f13e7+4
Debianlinux< 6.12.69-1+1

Patches

🔴Vulnerability Details

3
OSV
CVE-2026-23123: In the Linux kernel, the following vulnerability has been resolved: interconnect: debugfs: initialize src_node and dst_node to empty strings The debug2026-02-14
GHSA
GHSA-x5p5-6q7q-gj33: In the Linux kernel, the following vulnerability has been resolved: interconnect: debugfs: initialize src_node and dst_node to empty strings The deb2026-02-14
CVEList
interconnect: debugfs: initialize src_node and dst_node to empty strings2026-02-14

📋Vendor Advisories

2
Red Hat
kernel: Linux kernel: Local denial of service in interconnect debugfs due to uninitialized pointers2026-02-14
Debian
CVE-2026-23123: linux - In the Linux kernel, the following vulnerability has been resolved: interconnec...2026

🕵️Threat Intelligence

1
Wiz
CVE-2026-23123 Impact, Exploitability, and Mitigation Steps | Wiz
CVE-2026-23123 (MEDIUM CVSS 5.5) | In the Linux kernel | cvebase.io