CVE-2026-23187: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-23187 Overview

CVE-2026-23187 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel's pmdomain subsystem, specifically within the imx8m-blk-ctrl driver used on NXP i.MX8M system-on-chip platforms. The flaw resides in the imx8m_blk_ctrl_remove() function, which accesses the bc->domains array beyond its valid range during driver removal. A local authenticated attacker with the ability to trigger driver unloading can leverage this condition to impact kernel memory integrity and system availability. The vulnerability affects multiple Linux kernel releases, including 6.19 release candidates rc1 through rc8.

Critical Impact
A local attacker can trigger an out-of-bounds memory read during imx8m-blk-ctrl driver removal, potentially leading to kernel memory disclosure or denial of service on i.MX8M-based Linux systems.

Affected Products

Linux Kernel 6.19-rc1 through 6.19-rc8
Linux Kernel stable branches receiving the imx8m-blk-ctrl backport
Systems built on NXP i.MX8M family SoCs running affected kernels

Discovery Timeline

2026-02-14 - CVE-2026-23187 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-23187

Vulnerability Analysis

The vulnerability exists in the power management domain driver for i.MX8M block control hardware. The imx8m_blk_ctrl_remove() function iterates over the bc->domains array during driver teardown but uses an index that exceeds the array bounds. This results in an out-of-bounds read of kernel memory adjacent to the allocated structure.

The condition is classified as CWE-125 (Out-of-Bounds Read). On affected systems, triggering the cleanup path causes the kernel to dereference memory outside the intended array region. Depending on heap layout, this can produce kernel oops conditions, panic the system, or expose adjacent kernel data structures.

Exploitation requires local access on systems using the imx8m-blk-ctrl driver, which is specific to NXP i.MX8M-series ARM platforms commonly deployed in embedded devices, industrial controllers, and edge computing nodes.

Root Cause

The root cause is an incorrect loop boundary in the driver removal handler. The remove function references bc->domains[i] using an iterator that does not respect the actual count of allocated domain entries, producing an off-by-one or larger out-of-range access pattern. The upstream fix corrects the bounds calculation before dereferencing array members during cleanup.

Attack Vector

The attack vector is local. An attacker with sufficient privileges to unload kernel modules, trigger device unbind operations through sysfs, or initiate driver removal through device hot-removal can reach the vulnerable code path. Exploitation does not require user interaction once the trigger condition is met. The vulnerability mechanism is documented in the upstream commits referenced in the Kernel Git Commit 1 and related stable tree fixes.

Detection Methods for CVE-2026-23187

Indicators of Compromise

Unexpected kernel oops or panic messages referencing imx8m_blk_ctrl_remove in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds reads in the pmdomain/imx module
Unexplained driver unbind events through sysfs paths under /sys/bus/platform/drivers/imx8m-blk-ctrl/

Detection Strategies

Audit kernel versions across i.MX8M fleet inventory using uname -r and compare against patched stable releases
Enable KASAN on test builds to surface out-of-bounds access conditions before production deployment
Monitor for module load and unload events using auditd rules targeting init_module and delete_module syscalls

Monitoring Recommendations

Forward kernel ring buffer messages to centralized logging and alert on BUG:, KASAN:, or Oops: strings tied to the imx8m_blk_ctrl symbol
Track unauthorized privilege escalations or local account activity on embedded devices running affected kernels
Correlate device unbind operations with the originating user session and process tree

How to Mitigate CVE-2026-23187

Immediate Actions Required

Apply the upstream kernel patches from the stable tree commits referenced in the NVD advisory to all affected i.MX8M systems
Restrict access to /sys/bus/platform/drivers/ write operations to root-only contexts and remove unnecessary local user accounts
Disable kernel module unloading at runtime where operationally feasible by setting kernel.modules_disabled=1 after boot

Patch Information

Fixes are available in the Linux stable tree through the following commits: Kernel Git Commit 1, Kernel Git Commit 2, Kernel Git Commit 3, Kernel Git Commit 4, and Kernel Git Commit 5. Administrators should rebuild kernels from a patched source tree or pull the latest stable point release distributed by their Linux vendor.

Workarounds

Avoid runtime removal or rebind operations on the imx8m-blk-ctrl driver until patched kernels are deployed
Apply strict access controls on platform device sysfs entries to prevent non-root users from triggering driver teardown
Build kernels without CONFIG_IMX8M_BLK_CTRL where the hardware is not required for system operation

bash

# Configuration example: lock down module unloading after boot
echo 1 > /proc/sys/kernel/modules_disabled

# Restrict sysfs unbind access on affected driver
chmod 600 /sys/bus/platform/drivers/imx8m-blk-ctrl/unbind