CVE-2026-23237 in Linux
Summary
by MITRE • 03/04/2026
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: classmate-laptop: Add missing NULL pointer checks
In a few places in the Classmate laptop driver, code using the accel object may run before that object's address is stored in the driver data of the input device using it.
For example, cmpc_accel_sensitivity_store_v4() is the "show" method of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), before calling dev_set_drvdata() for inputdev->dev. If the sysfs attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) call in in cmpc_accel_sensitivity_store_v4() returns NULL which leads to a NULL pointer dereference going forward.
Moreover, sysfs attributes using the input device are added before initializing that device by cmpc_add_acpi_notify_device() and if one of them is accessed before running that function, a NULL pointer dereference will occur.
For example, cmpc_accel_sensitivity_attr_v4 is added before calling cmpc_add_acpi_notify_device() and if it is read prematurely, the dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() returns NULL which leads to a NULL pointer dereference going forward.
Fix this by adding NULL pointer checks in all of the relevant places.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/24/2026
The vulnerability described in CVE-2026-23237 represents a critical NULL pointer dereference issue within the Linux kernel's classmate-laptop platform driver specifically affecting the x86 architecture. This flaw manifests in the platform/x86 subsystem where the classmate-laptop driver fails to properly validate pointer references before accessing them, creating a potential pathway for system crashes or arbitrary code execution. The vulnerability stems from improper initialization sequencing within the driver's attribute handling mechanisms, where sysfs interface elements are registered before the underlying data structures they reference are fully established.
The technical implementation of this vulnerability occurs through improper ordering of initialization operations within the driver's setup process. Specifically, the cmpc_accel_sensitivity_store_v4() function serves as a "show" method for the cmpc_accel_sensitivity_attr_v4 attribute, which is registered during the cmpc_accel_add_v4() function call. However, this registration occurs before the dev_set_drvdata() operation is performed on the input device, creating a window where sysfs attribute access can trigger a NULL pointer dereference. The dev_get_drvdata(&inputdev->dev) call within this context returns NULL when accessed prematurely, leading directly to the kernel panic condition. This pattern repeats with other sysfs attributes that are added before the cmpc_add_acpi_notify_device() function completes its initialization, particularly affecting the cmpc_accel_sensitivity_attr_v4 attribute which accesses the acpi->dev structure through dev_get_drvdata(&acpi->dev) before the ACPI device structure is properly initialized.
The operational impact of this vulnerability extends beyond simple system instability to potentially enable privilege escalation or denial of service attacks. When an attacker can trigger the NULL pointer dereference through controlled sysfs attribute access, they effectively gain the ability to cause kernel crashes or potentially manipulate memory structures in ways that could lead to privilege escalation. This vulnerability particularly affects systems running Linux kernel versions where the classmate-laptop driver is active, with the attack surface limited to devices that utilize this specific platform driver. The flaw represents a classic race condition in kernel driver development where resource initialization order is not properly enforced, creating a security boundary that can be exploited by malicious actors with access to the system's sysfs interface.
The mitigation strategy for CVE-2026-23237 requires implementing comprehensive NULL pointer validation checks throughout the affected driver code sections. This fix addresses the core issue by ensuring that all functions accessing driver data structures perform proper validation before dereferencing pointers, following established kernel security practices and coding standards. The solution aligns with CWE-476 which specifically addresses NULL pointer dereference vulnerabilities, and incorporates defensive programming techniques recommended by the Linux kernel security team. The fix should be implemented by adding conditional checks that verify the return value of dev_get_drvdata() calls before proceeding with any operations that depend on the retrieved data, ensuring that the driver gracefully handles cases where initialization has not yet completed or where device structures are not yet available.
This vulnerability demonstrates the critical importance of proper initialization sequencing and resource management in kernel space programming, particularly within platform drivers that interface with hardware-specific components. The flaw exemplifies the ATT&CK technique of privilege escalation through kernel exploits, where improper validation of system resources creates opportunities for attackers to gain elevated privileges. The resolution of this issue through NULL pointer checks represents a fundamental defensive measure that should be applied to similar driver code patterns throughout the Linux kernel ecosystem. This vulnerability serves as a reminder that even seemingly minor initialization order issues can create significant security implications, emphasizing the need for rigorous code review processes and adherence to kernel security best practices during driver development and maintenance activities.