CVE-2026-23044 in Linux
Summary
by MITRE • 02/04/2026
In the Linux kernel, the following vulnerability has been resolved:
PM: hibernate: Fix crash when freeing invalid crypto compressor
When crypto_alloc_acomp() fails, it returns an ERR_PTR value, not NULL.
The cleanup code in save_compressed_image() and load_compressed_image() unconditionally calls crypto_free_acomp() without checking for ERR_PTR, which causes crypto_acomp_tfm() to dereference an invalid pointer and crash the kernel.
This can be triggered when the compression algorithm is unavailable (e.g., CONFIG_CRYPTO_LZO not enabled).
Fix by adding IS_ERR_OR_NULL() checks before calling crypto_free_acomp() and acomp_request_free(), similar to the existing kthread_stop() check.
[ rjw: Added 2 empty code lines ]
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/30/2026
The vulnerability described in CVE-2026-23044 represents a critical kernel panic condition within the Linux power management subsystem, specifically affecting the hibernation functionality. This issue resides in the kernel's handling of compressed image storage during system suspend operations, where the kernel attempts to allocate cryptographic compression components to process hibernation data. The flaw manifests when the system encounters a scenario where the required compression algorithm is not available in the kernel configuration, such as when CONFIG_CRYPTO_LZO is disabled. The vulnerability is particularly concerning because it directly impacts the kernel's ability to handle system state preservation, potentially leading to complete system crashes during hibernation operations.
The technical root cause of this vulnerability stems from improper error handling in the crypto compression subsystem during hibernation processes. When crypto_alloc_acomp() fails to allocate a compression algorithm component, it returns an ERR_PTR value rather than a NULL pointer as might be expected. However, the cleanup functions save_compressed_image() and load_compressed_image() contain code that unconditionally invokes crypto_free_acomp() without first validating whether the returned pointer represents a valid allocation or an error condition. This oversight creates a scenario where crypto_acomp_tfm() attempts to dereference an invalid pointer, resulting in a kernel crash. The flaw demonstrates a classic improper error handling pattern that violates fundamental kernel programming practices and security principles.
The operational impact of this vulnerability extends beyond simple system instability, as it can compromise the reliability of power management features critical to system uptime and user experience. System administrators and developers who rely on hibernation functionality for energy management or system maintenance operations face potential service disruption when encountering this condition. The vulnerability is particularly dangerous in embedded systems or server environments where hibernation might be used for maintenance windows or power optimization. Attackers could potentially exploit this condition to cause denial of service attacks against systems that depend on hibernation capabilities, though the direct attack surface is limited to scenarios where compression algorithms are disabled or unavailable.
The fix implemented for CVE-2026-23044 addresses the core issue by introducing proper error validation before calling cleanup functions, specifically implementing IS_ERR_OR_NULL() checks before invoking crypto_free_acomp() and acomp_request_free(). This approach mirrors existing patterns already used elsewhere in the kernel codebase, such as the established kthread_stop() error checking mechanism, demonstrating consistency with established kernel security practices. The solution aligns with CWE-476 which addresses NULL pointer dereference vulnerabilities and follows ATT&CK framework techniques related to privilege escalation through kernel exploitation. The fix ensures that error conditions are properly handled and that cleanup operations only occur on valid allocations, preventing the invalid pointer dereference that leads to kernel crashes.
This vulnerability highlights the importance of proper error handling in kernel space programming and the potential consequences of assuming pointer validity without explicit validation. The fix reinforces defensive programming practices that are essential for maintaining kernel stability and security. System maintainers should ensure that kernel updates incorporating this fix are applied promptly, particularly in environments where hibernation functionality is actively used. The vulnerability serves as a reminder of the critical nature of kernel-level error handling and the need for comprehensive testing of edge cases involving optional kernel features and configuration options. The resolution demonstrates how small code changes can have significant impact on system reliability, emphasizing the importance of code review processes that focus on error condition handling in security-critical kernel subsystems.