CVE-2026-23156
Unknown Unknown - Not Provided

Uninitialized Heap Memory Exposure in Linux efivarfs Component

Publication date: 2026-02-14

Last updated on: 2026-03-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: efivarfs: fix error propagation in efivar_entry_get() efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors. This may result in uninitialized heap memory being copied to userspace in the efivarfs_file_read() path. Fix it by returning the error from __efivar_entry_get().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-14
Last Modified
2026-03-18
Generated
2026-07-06
AI Q&A
2026-02-14
EPSS Evaluated
2026-07-05
NVD
CVE-2026-23156
EUVD
EUVD-2026-5881

Affected Vendors & Products

Showing 11 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel From 6.2 (inc) to 6.6.123 (exc)
linux linux_kernel 6.19
linux linux_kernel From 6.7 (inc) to 6.12.69 (exc)
linux linux_kernel 6.19
linux linux_kernel From 6.0 (inc) to 6.1.162 (exc)
linux linux_kernel From 6.13 (inc) to 6.18.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's efivarfs component, specifically in the function efivar_entry_get(). The function efivar_entry_get() always returns success even if the underlying function __efivar_entry_get() fails, which masks errors.

As a result, uninitialized heap memory may be copied to userspace during the efivarfs_file_read() operation. This means that potentially sensitive or random data from memory could be exposed unintentionally.

The fix involves changing efivar_entry_get() to properly return the error from __efivar_entry_get(), ensuring that failures are not hidden.

Impact Analysis

This vulnerability can impact you by potentially exposing uninitialized heap memory to userspace applications. This could lead to leakage of sensitive information or random memory contents that should not be accessible.

Such exposure might be exploited by attackers to gain insights into the system's memory layout or to extract confidential data unintentionally copied from kernel memory.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23156. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart