CVE-2026-23285 Linux CVE debrief

Who should care

Linux kernel administrators, especially teams running kernels with DRBD and environments where local users or low-privilege processes can access affected systems. Release and patch management teams should also care because remediation is branch-specific.

Technical summary

The bug is in the local read-error path. drbd_request_endio() invokes __req_mod(req, what, NULL, &m) for READ_COMPLETED_WITH_ERROR, so peer_device is NULL. The READ_COMPLETED_WITH_ERROR handler then unconditionally forwards that NULL pointer to drbd_set_out_of_sync(), which dereferences it. The fix is to obtain the peer device with first_peer_device(device), matching the handling used by drbd_req_destroy().

Defensive priority

Medium. The flaw is local-only and affects availability rather than confidentiality or integrity, but a kernel null-pointer dereference can still crash the system or interrupt service. Prioritize systems running affected kernel branches with DRBD in use.

Recommended defensive actions

• Apply the kernel fix or update to a non-vulnerable release for your branch: 6.6.130 or later, 6.12.77 or later, 6.18.17 or later, 6.19.7 or later, or the release containing the 7.0-rc1 fix.
• Confirm whether DRBD is present on Linux kernel hosts in scope, including vendor kernels that may carry backports.
• Validate any vendor backport against the published kernel.org patch references before marking systems remediated.
• If immediate patching is not possible, reduce exposure to local untrusted users on affected systems until updates are applied.

Evidence notes

The supplied CVE description states that READ_COMPLETED_WITH_ERROR can pass a NULL peer_device into drbd_set_out_of_sync(), resulting in a null-pointer dereference, and that the fix uses first_peer_device(device). The NVD record identifies CWE-476 and CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, and lists branch-specific vulnerable version ranges plus five official kernel.org patch references. This debrief uses only the provided corpus and official links.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.