CVE-2026-23285: Linux Kernel DRBD Null Pointer Vulnerability

CVE-2026-23285 Overview

A null-pointer dereference vulnerability has been discovered in the Linux kernel's DRBD (Distributed Replicated Block Device) subsystem. The vulnerability occurs in the drbd_request_endio() function when handling local read errors. When a READ_COMPLETED_WITH_ERROR event is passed to __req_mod() with a NULL peer_device parameter, the subsequent call to drbd_set_out_of_sync() unconditionally dereferences this NULL pointer, leading to a kernel crash.

Critical Impact
This vulnerability can cause kernel crashes and system instability on systems running DRBD for high-availability storage replication, potentially disrupting critical data replication services and causing denial of service conditions.

Affected Products

Linux kernel with DRBD module enabled
Systems using DRBD for distributed block device replication
High-availability storage clusters utilizing DRBD

Discovery Timeline

March 25, 2026 - CVE-2026-23285 published to NVD
March 25, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23285

Vulnerability Analysis

The vulnerability exists within the DRBD kernel module's error handling path. When a local read operation fails, the drbd_request_endio() function is invoked to handle the completion of the I/O request. The function passes the READ_COMPLETED_WITH_ERROR state to __req_mod() with a NULL value for the peer_device parameter.

The problematic code path occurs when the READ_COMPLETED_WITH_ERROR handler within __req_mod() unconditionally forwards the NULL peer_device to the drbd_set_out_of_sync() function. This function expects a valid peer_device structure and dereferences it without proper NULL checking, resulting in a null-pointer dereference that crashes the kernel.

This vulnerability is classified as a null-pointer dereference issue, which falls under memory corruption vulnerabilities. The impact is primarily denial of service through kernel panic, affecting system availability.

Root Cause

The root cause of this vulnerability is the absence of proper NULL pointer validation in the error handling code path. When drbd_request_endio() processes a local read error, it calls __req_mod(req, what, NULL, &m) with an explicitly NULL peer_device parameter. The READ_COMPLETED_WITH_ERROR handler fails to account for this NULL value before passing it to drbd_set_out_of_sync(), which blindly dereferences the pointer.

The fix involves obtaining a valid peer_device reference using first_peer_device(device), which mirrors the approach already implemented in drbd_req_destroy() for handling similar scenarios.

Attack Vector

The attack vector for this vulnerability is local. An attacker or fault condition that triggers a local read error on a DRBD-managed block device can cause the null-pointer dereference. This could occur through:

Hardware failures causing read errors on the underlying storage
Deliberate injection of I/O errors by a privileged local user
Corrupt filesystem or storage subsystem triggering read failures
Targeted I/O operations designed to produce read errors on DRBD devices

The vulnerability does not require network access and is triggered through local disk I/O operations that result in read errors being processed by the DRBD subsystem.

Detection Methods for CVE-2026-23285

Indicators of Compromise

Kernel panic messages referencing null-pointer dereference in DRBD functions such as drbd_set_out_of_sync() or __req_mod()
System crashes or unexpected reboots on hosts running DRBD replication
Kernel oops messages in system logs (/var/log/kern.log or dmesg) mentioning DRBD module functions

Detection Strategies

Monitor kernel logs for DRBD-related null-pointer dereference errors using tools like journalctl -k or log aggregation systems
Implement automated alerting on kernel panic events involving the DRBD module stack trace
Deploy host-based intrusion detection systems (HIDS) to detect unusual kernel crash patterns on DRBD nodes

Monitoring Recommendations

Configure centralized logging to capture kernel messages from all DRBD cluster nodes for correlation analysis
Set up monitoring dashboards to track system stability metrics and unexpected reboot events on storage infrastructure
Enable kernel crash dump collection using kdump or similar mechanisms to facilitate post-incident analysis

How to Mitigate CVE-2026-23285

Immediate Actions Required

Apply the latest kernel patches from your Linux distribution that include the DRBD null-pointer dereference fix
Review DRBD cluster health and ensure storage devices are not experiencing underlying hardware issues that could trigger read errors
Consider temporarily disabling DRBD on non-critical systems until patches can be applied if the risk of exploitation is deemed high

Patch Information

The vulnerability has been addressed in multiple Linux kernel stable releases. The fix modifies the error handling code to obtain a valid peer_device reference using first_peer_device(device) instead of passing NULL to drbd_set_out_of_sync().

Patches are available through the official Linux kernel git repositories:

Workarounds

Ensure underlying storage hardware is healthy to minimize the occurrence of read errors that could trigger the vulnerable code path
Implement proactive storage health monitoring with tools like smartctl to detect failing drives before they cause read errors
Consider using redundant storage configurations (RAID) beneath DRBD to reduce the likelihood of read errors propagating to the DRBD layer

bash

# Check for available kernel updates on Debian/Ubuntu systems
sudo apt update && apt list --upgradable | grep linux-image

# Check for available kernel updates on RHEL/CentOS systems
sudo yum check-update kernel

# Verify current kernel version
uname -r

# Check DRBD module version
modinfo drbd | grep version