CVE-2026-23156

What it actually does

efivar_entry_get() incorrectly returns success even when __efivar_entry_get() fails, causing efivarfs_file_read() to copy uninitialized heap memory to userspace.

Why it matters to the business

Local users on affected Linux systems may obtain fragments of kernel heap memory that could contain sensitive information such as credentials or internal state, increasing the risk of further compromise.

How an attack unfolds

An attacker with local access opens an efivarfs file for reading; because the error from the underlying EFI variable retrieval is ignored, the read path returns uninitialized memory instead of a proper error or zeroed buffer.

How to fix it

Update the Linux kernel to a version containing commit 3960f1754664661a970dc9ebbab44ff93a0b4c42 or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 3960f1754664661a970dc9ebbab44ff93a0b4c42; attempt to read an efivarfs file while simulating an EFI variable failure and verify that only an error or zeroed data is returned.

Typical attack path

1. Obtain local shell or process execution on the target Linux system
2. Locate or create an efivarfs mount point and enumerate EFI variable files
3. Open a variable file for reading and trigger efivar_entry_get()
4. Receive uninitialized kernel heap contents in the read buffer

How to detect it

Search kernel audit logs and process execution records for repeated or anomalous reads of efivarfs entries around the time of any unexpected memory disclosure; no public exploitation artifacts are known.

What your security team should do

• Prioritize patching production systems that expose efivarfs to untrusted local users
• Apply the fixed commit or newer kernel package and schedule reboots
• Review systems for any custom efivarfs usage or monitoring that may surface the bug