CVE-2026-23474 - Vulnerability Details

- mtd: Avoid boot crash in RedBoot partition table parser

Description

In the Linux kernel, the following vulnerability has been resolved:

mtd: Avoid boot crash in RedBoot partition table parser

Given CONFIG_FORTIFY_SOURCE=y and a recent compiler,
commit 439a1bcac648 ("fortify: Use __builtin_dynamic_object_size() when
available") produces the warning below and an oops.

Searching for RedBoot partition table in 50000000.flash at offset 0x7e0000
------------[ cut here ]------------
WARNING: lib/string_helpers.c:1035 at 0xc029e04c, CPU#0: swapper/0/1
memcmp: detected buffer overflow: 15 byte read of buffer size 14
Modules linked in:
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0 #1 NONE

As Kees said, "'names' is pointing to the final 'namelen' many bytes
of the allocation ... 'namelen' could be basically any length at all.
This fortify warning looks legit to me -- this code used to be reading
beyond the end of the allocation."

Since the size of the dynamic allocation is calculated with strlen()
we can use strcmp() instead of memcmp() and remain within bounds.

Published: 2026-04-03

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A bounded buffer overflow exists in the RedBoot partition table parser of the Linux kernel when modern compiler fortification options are enabled. The overflow occurs because a dynamically allocated buffer is accessed beyond its size, causing a kernel oops and eventual crash. This flaw is a classic example of CWE‑805 and results in a loss of service.

Affected Systems

The vulnerability is present in any Linux kernel that contains the affected parser code, including the 6.19.0 release referenced in the description and all later kernels that have not yet incorporated the upstream fix. Distributions shipping such kernels are therefore potentially affected until a patched kernel is deployed.

Risk and Exploitability

The probability of exploitation is currently very low, with an EPSS less than 1 %. The flaw is not listed in the CISA KEV catalog. The most likely way to trigger the issue is through a malicious RedBoot partition table encountered during system boot, which would require control over the firmware image or the boot environment. Successful exploitation would result in a kernel crash and complete loss of service, rather than data compromise or privilege escalation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ca235d11fc2fd8fce1dcd9d732dc780be0cde2de
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< e0065e106f798ce6862251bc4fc030ac5cead940
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 0b08be5aca212a99f8ba786fee4922feac08002c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d8570211a2b1ec886a462daa0be4e9983ac768bb
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 2025b2d1f9d5cad6ea6fe85654c6c41297c3130b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< c4054ad2d8bff4e8e937cd4a1d1a04c1e8f77a2c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 75a4d8cfe7784f909b3bd69325abac8e04ecb385
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 8e2f8020270af7777d49c2e7132260983e4fc566

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.20`	unaffected	≤ 6.18.*
`6.19.10`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0b08be5aca212a99f8ba786fee4922feac08002c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2025b2d1f9d5cad6ea6fe85654c6c41297c3130b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,75a4d8cfe7784f909b3bd69325abac8e04ecb385)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8e2f8020270af7777d49c2e7132260983e4fc566)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c4054ad2d8bff4e8e937cd4a1d1a04c1e8f77a2c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,75a4d8cfe7784f909b3bd69325abac8e04ecb385)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8e2f8020270af7777d49c2e7132260983e4fc566)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.78,6.13.0)`	unaffected	semver	—
`[6.18.20,6.19.0)`	unaffected	semver	—
`[6.19.10,6.20.0)`	unaffected	semver	—
`[7.0-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the commit fixing the buffer overflow issue.
Verify that the patch is present by checking the kernel source or vendor releases for the referenced commit changes.
If a kernel upgrade cannot be performed immediately, disable the RedBoot partition table feature or temporarily reduce the use of CONFIG_FORTIFY_SOURCE until the patch is available.

Generated by OpenCVE AI on April 7, 2026 at 10:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0004.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0b08be5aca212a99f8ba786fee4922feac08002c
https://git.kernel.org/stable/c/2025b2d1f9d5cad6ea6fe85654c6c41297c3130b
https://git.kernel.org/stable/c/75a4d8cfe7784f909b3bd69325abac8e04ecb385
https://git.kernel.org/stable/c/8e2f8020270af7777d49c2e7132260983e4fc566
https://git.kernel.org/stable/c/c4054ad2d8bff4e8e937cd4a1d1a04c1e8f77a2c
https://git.kernel.org/stable/c/ca235d11fc2fd8fce1dcd9d732dc780be0cde2de
https://git.kernel.org/stable/c/d8570211a2b1ec886a462daa0be4e9983ac768bb
https://git.kernel.org/stable/c/e0065e106f798ce6862251bc4fc030ac5cead940
https://lore.kernel.org/linux-cve-announce/2026040323-CVE-2026-23474-e350@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23474
https://www.cve.org/CVERecord?id=CVE-2026-23474

History

Sat, 18 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/ca235d11fc2fd8fce1dcd9d732dc780be0cde2de https://git.kernel.org/stable/c/e0065e106f798ce6862251bc4fc030ac5cead940

Tue, 07 Apr 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Sat, 04 Apr 2026 01:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-805
References		https://lore.kernel.org/linux-cve-announce/2026040323-CVE-2026-23474-e350@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23474 https://www.cve.org/CVERecord?id=CVE-2026-23474

Fri, 03 Apr 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Fri, 03 Apr 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mtd: Avoid boot crash in RedBoot partition table parser Given CONFIG_FORTIFY_SOURCE=y and a recent compiler, commit 439a1bcac648 ("fortify: Use __builtin_dynamic_object_size() when available") produces the warning below and an oops. Searching for RedBoot partition table in 50000000.flash at offset 0x7e0000 ------------[ cut here ]------------ WARNING: lib/string_helpers.c:1035 at 0xc029e04c, CPU#0: swapper/0/1 memcmp: detected buffer overflow: 15 byte read of buffer size 14 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0 #1 NONE As Kees said, "'names' is pointing to the final 'namelen' many bytes of the allocation ... 'namelen' could be basically any length at all. This fortify warning looks legit to me -- this code used to be reading beyond the end of the allocation." Since the size of the dynamic allocation is calculated with strlen() we can use strcmp() instead of memcmp() and remain within bounds.
Title		mtd: Avoid boot crash in RedBoot partition table parser
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b08be5aca212a99f8ba786fee4922feac08002c https://git.kernel.org/stable/c/2025b2d1f9d5cad6ea6fe85654c6c41297c3130b https://git.kernel.org/stable/c/75a4d8cfe7784f909b3bd69325abac8e04ecb385 https://git.kernel.org/stable/c/8e2f8020270af7777d49c2e7132260983e4fc566 https://git.kernel.org/stable/c/c4054ad2d8bff4e8e937cd4a1d1a04c1e8f77a2c https://git.kernel.org/stable/c/d8570211a2b1ec886a462daa0be4e9983ac768bb

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-03T15:15:53.406Z

Updated: 2026-04-18T08:59:13.577Z

Reserved: 2026-01-13T15:37:46.022Z

Link: CVE-2026-23474

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-04-03T16:16:35.260

Modified: 2026-04-18T09:16:29.257

Link: CVE-2026-23474

Redhat

Severity :

Publid Date: 2026-04-03T00:00:00Z

Links: CVE-2026-23474 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-08T19:53:36Z

Weaknesses

CWE-805

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object