CVE-2026-23474: Linux kernel · mtd: Avoid boot crash in RedBoot partition table parser
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in e0065e106f798ce6862251bc4fc030ac5cead940 : update Linux kernel when convenient.
Data as of 10 Nov 2026, 13:06 UTC
Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- Patch
- Available – fixed in e0065e106f798ce6862251bc4fc030ac5cead940, d8570211a2b1ec886a462daa0be4e9983ac768bb, ca235d11fc2fd8fce1dcd9d732dc780be0cde2de +5
Exploitation evidence
Disclosed: evidence found.
CVE published 3 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been applied in several Linux kernel commits. Users should update to a Linux kernel version that includes these fixes to avoid the boot crash caused by this vulnerability.
Description
CVE-2026-23474 is a vulnerability in the Linux kernel's mtd subsystem affecting the RedBoot partition table parser. The issue causes a boot crash due to a buffer overflow detected by the fortify source feature when parsing the partition table. The flaw arises from reading beyond the allocated buffer size during a memcmp operation, which is corrected by switching to strcmp to stay within bounds.
References
- git.kernel.org/stable/c/ca235d11fc2fd8fce1dcd9d732dc780be0cde2de (opens in a new tab)
- git.kernel.org/stable/c/e0065e106f798ce6862251bc4fc030ac5cead940 (opens in a new tab)
- git.kernel.org/stable/c/0b08be5aca212a99f8ba786fee4922feac08002c (opens in a new tab)
- git.kernel.org/stable/c/d8570211a2b1ec886a462daa0be4e9983ac768bb (opens in a new tab)
- git.kernel.org/stable/c/2025b2d1f9d5cad6ea6fe85654c6c41297c3130b (opens in a new tab)
- git.kernel.org/stable/c/c4054ad2d8bff4e8e937cd4a1d1a04c1e8f77a2c (opens in a new tab)
- git.kernel.org/stable/c/75a4d8cfe7784f909b3bd69325abac8e04ecb385 (opens in a new tab)
- git.kernel.org/stable/c/8e2f8020270af7777d49c2e7132260983e4fc566 (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-082556.html (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-019113.html (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-457936.html (opens in a new tab)