Executive brief
A vulnerability in the Linux kernel's RedBoot partition table parser can cause a system crash (kernel oops) during the boot process. This component is responsible for identifying disk partitions on certain embedded systems. An exploit or a malformed partition table could lead to a denial-of-service by preventing the system from starting correctly.
Technical details
A buffer overflow exists in the RedBoot partition table parser (drivers/mtd/parsers/redboot.c) within the Linux kernel. The vulnerability is triggered when the parser uses memcmp() to compare partition names, potentially reading beyond the end of a dynamically allocated buffer if the 'namelen' exceeds the allocation size. This issue was highlighted by CONFIG_FORTIFY_SOURCE=y and recent compilers using __builtin_dynamic_object_size(). An attacker with the ability to provide a malformed partition table could trigger a kernel oops, leading to a denial of service. The fix replaces the unsafe memcmp() calls with strcmp() to ensure comparisons remain within the bounds of the allocated string.
Affected products
- Linux Linux Kernel 2.6.12-rc2 to 6.19.10
Timeline
- 2026-04-03: advisory: Initial disclosure of CVE-2026-23474
- 2026-02-16: patched: Fix authored by Finn Thain
References
- https://git.kernel.org/stable/c/0b08be5aca212a99f8ba786fee4922feac08002c
- https://git.kernel.org/stable/c/2025b2d1f9d5cad6ea6fe85654c6c41297c3130b
- https://git.kernel.org/stable/c/75a4d8cfe7784f909b3bd69325abac8e04ecb385
- https://git.kernel.org/stable/c/8e2f8020270af7777d49c2e7132260983e4fc566
- https://git.kernel.org/stable/c/c4054ad2d8bff4e8e937cd4a1d1a04c1e8f77a2c
- https://git.kernel.org/stable/c/ca235d11fc2fd8fce1dcd9d732dc780be0cde2de
- https://git.kernel.org/stable/c/d8570211a2b1ec886a462daa0be4e9983ac768bb