CVE-2026-23123

What it actually does

Uninitialized src_node and dst_node pointers passed to debugfs_create_str() in the interconnect subsystem violate the API contract requiring NULL or kmalloc-backed strings, enabling invalid memory dereferences on debugfs reads or writes.

Why it matters to the business

Local denial-of-service risk on Linux systems using the interconnect debugfs interface; low exploitation probability reduces immediate operational disruption but still requires patching to maintain kernel stability.

How an attack unfolds

A local user with access to the interconnect debugfs directory triggers reads or writes against the uninitialized string pointers, causing the kernel to access invalid memory and panic.

How to fix it

Apply the upstream fix by updating the Linux kernel to commit aa79a5a959c7c414bd6fba01ea8dbaddd44f13e7 or later stable release containing the initialization of src_node and dst_node to empty strings.

How to confirm the fix worked

Confirm the patch commit is present in the running kernel source or verify the interconnect debugfs initialization code no longer leaves pointers uninitialized; test debugfs read/write operations under the interconnect directory.

Typical attack path

1. Obtain local shell access on an affected Linux system
2. Navigate to the interconnect debugfs directory
3. Perform read or write operations on src_node or dst_node entries
4. Trigger kernel memory access violation and system crash

How to detect it

Review kernel logs for oops or panic messages referencing interconnect debugfs or uninitialized string pointers; correlate with user activity on debugfs mounts.

What your security team should do

• Prioritize kernel updates containing commit aa79a5a959c7c414bd6fba01ea8dbaddd44f13e7 across all affected distributions
• Restrict unprivileged access to debugfs where feasible until patched
• Include the interconnect debugfs code paths in future kernel fuzzing and static analysis runs