CVE-2026-23156
Uninitialized Heap Memory Exposure in Linux efivarfs Component
Publication date: 2026-02-14
Last updated on: 2026-03-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.2 (inc) to 6.6.123 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.7 (inc) to 6.12.69 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.0 (inc) to 6.1.162 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's efivarfs component, specifically in the function efivar_entry_get(). The function efivar_entry_get() always returns success even if the underlying function __efivar_entry_get() fails, which masks errors.
As a result, uninitialized heap memory may be copied to userspace during the efivarfs_file_read() operation. This means that potentially sensitive or random data from memory could be exposed unintentionally.
The fix involves changing efivar_entry_get() to properly return the error from __efivar_entry_get(), ensuring that failures are not hidden.
How can this vulnerability impact me? :
This vulnerability can impact you by potentially exposing uninitialized heap memory to userspace applications. This could lead to leakage of sensitive information or random memory contents that should not be accessible.
Such exposure might be exploited by attackers to gain insights into the system's memory layout or to extract confidential data unintentionally copied from kernel memory.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know