CVE-2026-23156: Linux Kernel Information Disclosure Flaw

CVE-2026-23156 Overview

CVE-2026-23156 is an Uninitialized Memory Use vulnerability in the Linux kernel's efivarfs (EFI Variables Filesystem) subsystem. The vulnerability exists in the efivar_entry_get() function, which incorrectly returns success even when the underlying __efivar_entry_get() function fails. This improper error propagation can result in uninitialized heap memory being copied to userspace through the efivarfs_file_read() path.

Critical Impact

This vulnerability may allow local attackers to read uninitialized kernel heap memory, potentially exposing sensitive information from kernel memory space to userspace applications.

Affected Products

• Linux Kernel (multiple versions with efivarfs support)
• Systems with EFI/UEFI firmware utilizing efivarfs

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-23156 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23156

Vulnerability Analysis

This vulnerability represents a classic error handling flaw in kernel code where error conditions are silently ignored. The efivar_entry_get() function acts as a wrapper that calls __efivar_entry_get() to retrieve EFI variable data. However, when the internal function fails and returns an error code, the wrapper function incorrectly masks this error and returns success to its callers.

The consequence of this flawed error propagation is significant: when a read operation fails but appears successful, the caller proceeds to use the buffer that was intended to be filled with EFI variable data. Since the underlying read operation failed, this buffer may contain uninitialized heap memory. The efivarfs_file_read() function then copies this potentially sensitive kernel heap data to userspace.

Root Cause

The root cause is improper error handling in the efivar_entry_get() function. The function fails to propagate the return value from __efivar_entry_get(), instead always returning a success status (0) regardless of whether the underlying operation succeeded or failed. This violates the expected contract between the wrapper function and its callers, leading to incorrect assumptions about the validity of retrieved data.

Attack Vector

The attack vector for this vulnerability is local, requiring the attacker to have access to the affected system with permissions to read from the efivarfs filesystem (typically mounted at /sys/firmware/efi/efivars/). An attacker could:

1. Craft specific read requests to EFI variables that trigger failure conditions in __efivar_entry_get()
2. Exploit race conditions or edge cases that cause the underlying function to fail
3. Repeatedly read EFI variable files to harvest uninitialized kernel heap memory

The information disclosed could potentially include sensitive kernel data structures, memory addresses useful for defeating KASLR, or fragments of other security-sensitive information that happened to reside in kernel heap memory.

Detection Methods for CVE-2026-23156

Indicators of Compromise

• Unusual read patterns on efivarfs mounted filesystems (typically /sys/firmware/efi/efivars/)
• Processes repeatedly reading EFI variables with unexpected read patterns
• Applications accessing efivarfs that don't typically require UEFI variable access
• Kernel log messages indicating EFI variable read failures without corresponding application errors

Detection Strategies

• Monitor system calls targeting /sys/firmware/efi/efivars/ for anomalous access patterns
• Implement file integrity monitoring on efivarfs access logs
• Deploy kernel-level auditing for efivarfs operations using auditd or similar frameworks
• Use SentinelOne's kernel-level monitoring to detect suspicious memory access patterns

Monitoring Recommendations

• Enable kernel auditing for file operations on /sys/firmware/efi/efivars/
• Monitor for processes with elevated privileges accessing EFI variables unexpectedly
• Implement behavioral analysis to detect information disclosure attempt patterns
• Review system logs for EFI-related error messages that may indicate exploitation attempts

How to Mitigate CVE-2026-23156

Immediate Actions Required

• Update the Linux kernel to a patched version as soon as available
• Restrict access to efivarfs by limiting permissions on /sys/firmware/efi/efivars/
• Review and audit processes that require access to EFI variables
• Consider unmounting efivarfs on systems where UEFI variable access is not required

Patch Information

The Linux kernel maintainers have released patches to fix this vulnerability. The fix involves properly returning the error code from __efivar_entry_get() instead of masking it. Multiple commits have been published to stable kernel branches:

• Kernel Git Commit 3960f17
• Kernel Git Commit 4b22ec1
• Kernel Git Commit 510a16f
• Kernel Git Commit 89b8ca7
• Kernel Git Commit e4e15a0

Workarounds

• Restrict efivarfs access to root-only using filesystem permissions
• Unmount efivarfs on systems that don't require runtime UEFI variable manipulation
• Use mandatory access control frameworks (SELinux, AppArmor) to limit efivarfs access to authorized processes only
• Consider using immutable flag on critical EFI variables if supported

# Configuration example
# Restrict efivarfs access permissions
chmod 700 /sys/firmware/efi/efivars/

# Optional: Unmount efivarfs if not needed
umount /sys/firmware/efi/efivars/

# Prevent automatic mounting (add to /etc/fstab)
# efivarfs /sys/firmware/efi/efivars efivarfs noauto,nosuid,nodev,noexec 0 0