PT-2026-8202 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-02-14 · CVE-2026-23194

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel's rust binder component related to handling FDA (fd array) objects. Specifically, the issue arises when processing empty FDA objects with a length of zero, leading to a potential out-of-bounds write error. The previous implementation incorrectly interpreted a skip length of zero, resulting in an attempt to write beyond the allocated buffer when the FDA was located at the end of the buffer. This condition triggered an EINVAL error in userspace. The root cause was identified by Gemini CLI.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-23194

Affected Products

Linux Kernel

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23194.json · Exploit
• https://git.kernel.org/stable/c/598fe3ff32e43918ed8a062f55432b3d23e6340c · Patch
• https://git.kernel.org/stable/c/8f589c9c3be539d6c2b393c82940c3783831082f · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23194 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23194 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-23194 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23194 · Security Note
• https://ubuntu.com/security/CVE-2026-23194 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23194 · Vendor Advisory
• https://git.kernel.org/linus/8f589c9c3be539d6c2b393c82940c3783831082f · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://t.me/CVEtracker/44730 · Telegram Post
• https://twitter.com/CVEnew/status/2022716614899077619 · Twitter Post