Junglewise Threat Intelligence

CVE-2026-23474: Linux Kernel buffer overflow in RedBoot partition table parser

CVE-2026-23474 · Severity: medium · CVSS 5.5 · Published 2026-04-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's RedBoot partition table parser can cause a system crash (kernel oops) during the boot process. This component is responsible for identifying disk partitions on certain embedded systems. An exploit or a malformed partition table could lead to a denial-of-service by preventing the system from starting correctly.

Technical details

A buffer overflow exists in the RedBoot partition table parser (drivers/mtd/parsers/redboot.c) within the Linux kernel. The vulnerability is triggered when the parser uses memcmp() to compare partition names, potentially reading beyond the end of a dynamically allocated buffer if the 'namelen' exceeds the allocation size. This issue was highlighted by CONFIG_FORTIFY_SOURCE=y and recent compilers using __builtin_dynamic_object_size(). An attacker with the ability to provide a malformed partition table could trigger a kernel oops, leading to a denial of service. The fix replaces the unsafe memcmp() calls with strcmp() to ensure comparisons remain within the bounds of the allocated string.

Affected products

  • Linux Linux Kernel 2.6.12-rc2 to 6.19.10

Timeline

  • 2026-04-03: advisory: Initial disclosure of CVE-2026-23474
  • 2026-02-16: patched: Fix authored by Finn Thain

References

Related threats