CVE-2026-23002: Linux Kernel Privilege Escalation Bug

CVE-2026-23002 Overview

CVE-2026-23002 is a NULL pointer dereference vulnerability in the Linux kernel's lib/buildid component. The flaw triggers a kernel BUG in filemap_read_folio when the build ID extraction code accesses the page cache from a sleepable context using read_cache_folio(). A local low-privileged user can trigger the condition, causing a kernel crash and denial of service. The issue was discovered through Syzbot fuzzing and is tracked under [CWE-476: NULL Pointer Dereference].

Critical Impact
Local users can crash the kernel by triggering build ID lookups against files whose pages are not safely accessible from sleepable contexts, resulting in a denial of service on affected hosts.

Affected Products

Linux kernel 6.12 (release)
Linux kernel 6.19-rc1 through 6.19-rc8
Stable kernel branches prior to the merged fix commits

Discovery Timeline

2026-01-25 - CVE-2026-23002 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23002

Vulnerability Analysis

The Linux kernel's lib/buildid subsystem extracts ELF build IDs from executable files, typically for stack traces, perf events, and BPF identification. The original implementation in freader used direct page cache access via read_cache_folio() to read file data. When invoked from a sleepable context, this code path could reach filemap_read_folio() with a folio state that produced a NULL pointer dereference, crashing the kernel.

The fix converts the sleepable path to use __kernel_read(), the standard kernel file reading interface that correctly handles folio allocation, readahead, and error conditions. The non-sleepable path continues to use filemap_get_folio() and only succeeds when target folios are already cached and up-to-date. The maintainers kept the non-sleepable path unchanged to simplify backporting to stable kernels.

Root Cause

The root cause is improper use of read_cache_folio() from a context that can sleep but does not satisfy the assumptions of the page cache reader. Under specific folio states, filemap_read_folio() dereferences a NULL pointer because the caller did not provide the file context expected by the standard read path.

Attack Vector

Exploitation requires local access with low privileges. An attacker triggers build ID extraction against a crafted or unusual file mapping, for example through perf, BPF, or other subsystems that resolve build IDs for user-space binaries. The kernel then panics in filemap_read_folio, producing a denial of service. The vulnerability does not provide confidentiality or integrity impact.

No public proof-of-concept exploit is available, and the Syzbot reproducer no longer crashes patched kernels.

Detection Methods for CVE-2026-23002

Indicators of Compromise

Kernel oops or panic messages referencing BUG: unable to handle kernel NULL pointer dereference in filemap_read_folio
Stack traces containing freader, build_id_parse, or lib/buildid frames at the time of the crash
Unexpected reboots on hosts running kernels 6.12 or 6.19-rc series with active perf or BPF build ID lookups

Detection Strategies

Inspect /var/log/kern.log, dmesg, and journalctl -k for repeated kernel NULL pointer dereferences originating in filemap_read_folio
Correlate kernel crash timestamps with workloads invoking perf record, BPF programs using BPF_F_STACK_BUILD_ID, or coredump handlers
Compare running kernel versions against the fixed commits 568aeb34, 777a8560, and b11dfb77 referenced in the kernel.org advisories

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on filemap_read_folio NULL dereferences
Track kernel package versions across the fleet to identify hosts running affected 6.12 and 6.19-rc builds
Monitor host availability metrics for unexplained reboots that coincide with perf or BPF activity

How to Mitigate CVE-2026-23002

Immediate Actions Required

Apply the upstream patches that switch lib/buildid to __kernel_read() for sleepable contexts
Update to a stable kernel release that incorporates commits 568aeb3476c7, 777a8560fd29, and b11dfb7708f2
Restrict local shell access on multi-tenant systems until patched kernels are deployed

Patch Information

The Linux kernel maintainers resolved this issue in lib/buildid by replacing direct page cache access with __kernel_read() in the sleepable code path. Patch details are available in the kernel.org commits: Kernel commit 568aeb34, Kernel commit 777a8560, and Kernel commit b11dfb77. Distribution vendors should ship updated kernel packages incorporating these commits.

Workarounds

Limit untrusted local user access on affected hosts until patched kernels are installed
Disable or restrict BPF and perf features that invoke build ID extraction for unprivileged users by tightening kernel.perf_event_paranoid and kernel.unprivileged_bpf_disabled sysctls
Reboot into a known-good kernel from the stable branch if crashes occur in production

bash

# Configuration example: restrict unprivileged access to perf and BPF
sudo sysctl -w kernel.perf_event_paranoid=3
sudo sysctl -w kernel.unprivileged_bpf_disabled=1

# Persist settings
echo 'kernel.perf_event_paranoid = 3' | sudo tee -a /etc/sysctl.d/99-cve-2026-23002.conf
echo 'kernel.unprivileged_bpf_disabled = 1' | sudo tee -a /etc/sysctl.d/99-cve-2026-23002.conf

# Verify running kernel against patched stable releases
uname -r