Junglewise Threat Intelligence

CVE-2026-23285: Linux Kernel DRBD null pointer dereference on local read error

CVE-2026-23285 · Severity: medium · CVSS 5.5 · Published 2026-03-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Distributed Replicated Block Device (DRBD) driver can cause a system crash. DRBD is used to mirror storage between servers for high availability. If a local disk read error occurs, the system may encounter a 'null-pointer dereference,' leading to a kernel panic and service interruption.

Technical details

A NULL pointer dereference exists in the Linux kernel's DRBD driver within the `drbd_request_endio()` function. When a `READ_COMPLETED_WITH_ERROR` event occurs, the code passes a NULL `peer_device` to `__req_mod()`, which then passes it to `drbd_set_out_of_sync()`. Because `drbd_set_out_of_sync()` unconditionally dereferences this pointer, it causes a kernel panic. The fix involves correctly obtaining the `peer_device` using `first_peer_device(device)` before the call. This issue affects local users who can trigger or benefit from storage I/O error handling paths.

Affected products

  • Linux Linux Kernel 6.4 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7

Timeline

  • 2026-02-20: patched: Initial patch committed to mainline kernel
  • 2026-03-25: advisory: CVE published by kernel.org

References

Related threats