PT-2026-4664 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-02-27 · CVE-2026-23002

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s lib/buildid component related to handling kernel NULL pointer dereferences during file reading in sleepable contexts. Specifically, the issue involves using direct page cache access via read cache folio() which can lead to a kernel crash. The resolution involves converting to kernel read() for sleepable contexts to utilize the standard kernel file reading interface, simplifying the faultable code path. The fix prevents a "BUG: unable to handle kernel NULL pointer dereference in filemap read folio". The initial fix focuses on sleepable contexts to simplify backporting to stable kernels, with plans for future improvements to support non-sleepable contexts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2026-01112

CVE-2026-23002

OPENSUSE-SU-2026:20287-1

SUSE-SU-2026:20555-1

SUSE-SU-2026:20599-1

SUSE-SU-2026:20615-1

Affected Products

Linux Kernel

References · 466

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23002.json · Exploit
• https://git.kernel.org/stable/c/568aeb3476c770a3863c755dd2a199c212434286 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:20287-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01112 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:20555-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20615-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20599-1 · Vendor Advisory
• https://git.kernel.org/stable/c/b11dfb7708f212b96c7973a474014c071aa02e05 · Patch
• https://git.kernel.org/stable/c/777a8560fd29738350c5094d4166fe5499452409 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23002 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-23002 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-23002 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23002 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23002 · Vendor Advisory