CVE-2026-23237: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23237 Overview

CVE-2026-23237 is a NULL pointer dereference vulnerability [CWE-476] in the Linux kernel's platform/x86: classmate-laptop driver. The flaw exists because code paths in the Classmate laptop driver may access the accel object before its address is stored in the driver data of the associated input device. A local user with access to the relevant sysfs attributes can trigger a kernel NULL pointer dereference, resulting in a denial of service against the host. The issue affects multiple Linux kernel versions from 2.6.33 through 6.19-rc8 and has been resolved upstream by adding the missing NULL pointer checks in all affected code paths.

Critical Impact
Local low-privileged users can crash the Linux kernel by accessing classmate-laptop sysfs attributes before the input device is fully initialized.

Affected Products

Linux Kernel 2.6.33 (including release candidates rc2 through rc8)
Linux Kernel 6.19 release candidates rc1 through rc8
Linux distributions shipping the classmate-laptop platform driver on x86 Classmate hardware

Discovery Timeline

2026-03-04 - CVE-2026-23237 published to NVD
2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-23237

Vulnerability Analysis

The vulnerability resides in the classmate-laptop platform driver located under platform/x86 in the Linux kernel source tree. The driver exposes accelerometer functionality through sysfs attributes tied to an input device. The defect is a classic ordering bug: sysfs attributes that depend on the accel driver data become accessible before dev_set_drvdata() populates that data on the input device.

For example, cmpc_accel_sensitivity_store_v4() is the store method for cmpc_accel_sensitivity_attr_v4. This attribute is registered in cmpc_accel_add_v4() before the corresponding dev_set_drvdata() call for inputdev->dev. A premature write to the sysfs file causes dev_get_drvdata(&inputdev->dev) to return NULL, leading to a dereference of an invalid pointer in subsequent code.

A similar race exists at the ACPI device layer. Attributes that use the input device are added before cmpc_add_acpi_notify_device() initializes that device. If cmpc_accel_sensitivity_show_v4() is invoked first, the call to dev_get_drvdata(&acpi->dev) returns NULL and triggers a kernel oops.

Root Cause

The root cause is missing NULL pointer validation combined with an initialization order defect. Sysfs attributes are exposed to userspace before the backing driver-private data structures are linked to their parent devices. Userspace can win this race because sysfs visibility precedes dev_set_drvdata() and cmpc_add_acpi_notify_device().

Attack Vector

Exploitation requires local access with sufficient privileges to read or write the affected sysfs files under /sys/. The attack is timing-sensitive and must occur during the narrow window between attribute creation and driver-data assignment. A successful trigger results in a kernel NULL pointer dereference, producing a kernel panic or oops depending on configuration. Confidentiality and integrity are not affected; the impact is limited to availability of the host system. No exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-23237

Indicators of Compromise

Kernel oops or panic messages in dmesg referencing cmpc_accel_sensitivity_show_v4, cmpc_accel_sensitivity_store_v4, or related cmpc_accel_* symbols.
Unexpected system crashes on Classmate-class x86 hardware during early boot or driver load.
Repeated reads or writes to /sys/ accelerometer attributes from non-administrative processes captured in audit logs.

Detection Strategies

Monitor kernel ring buffer output for NULL pointer dereference stack traces involving the classmate-laptop module.
Apply Linux audit rules to log accesses to sysfs paths exposed by the classmate-laptop driver, correlating reads and writes with system stability events.
Inventory affected hosts by checking installed kernel versions against the patched commits listed in the upstream advisory.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform to surface oops events linked to cmpc_accel_* functions.
Track kernel package versions across the fleet and alert on hosts still running vulnerable 2.6.33 or 6.19-rc builds.
Enable kdump or persistent crash collection on Classmate hardware to capture forensic data if the issue is triggered.

How to Mitigate CVE-2026-23237

Immediate Actions Required

Update the Linux kernel to a version that includes the upstream NULL pointer check fixes referenced by the kernel.org commits.
Restrict local access to systems running the classmate-laptop driver until patches are deployed.
If patching is not immediately possible, unload or blacklist the classmate_laptop kernel module on systems that do not require accelerometer functionality.

Patch Information

The fix adds explicit NULL pointer checks in all of the affected classmate-laptop code paths so that premature sysfs access returns cleanly instead of dereferencing an unset pointer. The patches are available in the upstream stable kernel tree as commits 97528b1622, 993708fc18d, 9cf4b9b8ad0, af673209d43, da6e06a5fdb, eb214804f03, and fe747d71122. Distribution-provided kernel updates that incorporate these commits should be applied as soon as they become available.

Workarounds

Blacklist the classmate_laptop module on hosts that do not depend on accelerometer functionality by adding blacklist classmate_laptop to a file under /etc/modprobe.d/.
Tighten permissions on the affected sysfs attributes so that only root can read or write them, reducing the unprivileged attack surface.
Limit interactive local logins on Classmate hardware to trusted administrators until patched kernels are deployed.

bash

# Configuration example: blacklist the classmate-laptop module
echo "blacklist classmate_laptop" | sudo tee /etc/modprobe.d/blacklist-classmate.conf
sudo modprobe -r classmate_laptop 2>/dev/null || true
sudo update-initramfs -u