Linux Kernel up to 6.18.6/6.19-rc5 block uninitialized pointer

Summaryinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.18.6/6.19-rc5. This affects an unknown function of the component block. The manipulation results in uninitialized pointer. This vulnerability is cataloged as CVE-2026-23007. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.18.6/6.19-rc5. It has been classified as critical. Affected is some unknown functionality of the component block. The manipulation with an unknown input leads to a uninitialized pointer vulnerability. CWE is classifying the issue as CWE-824. The product accesses or uses a pointer that has not been initialized. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer for writes needs to be fully initialized before being passed to the underlying block device, otherwise the uninitialized memory can be read back by userspace or anyone with physical access to the storage device. If protection information is generated, that portion of the integrity buffer is already initialized. The integrity data is also zeroed if PI generation is disabled via sysfs or the PI tuple size is 0. However, this misses the case where PI is generated and the PI tuple size is nonzero, but the metadata size is larger than the PI tuple. In this case, the remainder ("opaque") of the metadata is left uninitialized. Generalize the BLK_INTEGRITY_CSUM_NONE check to cover any case when the metadata is larger than just the PI tuple.

The advisory is available at git.kernel.org. This vulnerability is traded as CVE-2026-23007 since 01/13/2026. The exploitability is told to be easy. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 03/27/2026).

The vulnerability scanner Nessus provides a plugin with the ID 296527 (Linux Distros Unpatched Vulnerability : CVE-2026-23007), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.7 or 6.19-rc6 eliminates this vulnerability. Applying the patch d6072557b90e0c557df319a56f4a9dc482706d2c/ca22c566b89164f6e670af56ecc45f47ef3df819 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (296527), EUVD (EUVD-2026-4628) and CERT Bund (WID-SEC-2026-0215). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.19-rc1
• 6.19-rc2
• 6.19-rc3
• 6.19-rc4
• 6.19-rc5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion