Skip to main content
VulnerabilityPublished Updated

CVE-2026-23474: Linux kernel · mtd: Avoid boot crash in RedBoot partition table parser

Affects Linux kernelSource CVE Database V5

0
Compare

Not known to be exploited · fixed in e0065e106f798ce6862251bc4fc030ac5cead940 : update Linux kernel when convenient.

Data as of 10 Nov 2026, 13:06 UTC

Severity
Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none
Patch
Available – fixed in e0065e106f798ce6862251bc4fc030ac5cead940, d8570211a2b1ec886a462daa0be4e9983ac768bb, ca235d11fc2fd8fce1dcd9d732dc780be0cde2de +5

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 3 Apr 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < e0065e106f798ce6862251bc4fc030ac5cead940
Fixed in
  • e0065e106f798ce6862251bc4fc030ac5cead940
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < d8570211a2b1ec886a462daa0be4e9983ac768bb
Fixed in
  • d8570211a2b1ec886a462daa0be4e9983ac768bb
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < ca235d11fc2fd8fce1dcd9d732dc780be0cde2de
Fixed in
  • ca235d11fc2fd8fce1dcd9d732dc780be0cde2de
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < c4054ad2d8bff4e8e937cd4a1d1a04c1e8f77a2c
Fixed in
  • c4054ad2d8bff4e8e937cd4a1d1a04c1e8f77a2c
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 2025b2d1f9d5cad6ea6fe85654c6c41297c3130b
Fixed in
  • 2025b2d1f9d5cad6ea6fe85654c6c41297c3130b
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 75a4d8cfe7784f909b3bd69325abac8e04ecb385
Fixed in
  • 75a4d8cfe7784f909b3bd69325abac8e04ecb385

AI-suggested

A fix is available and has been applied in several Linux kernel commits. Users should update to a Linux kernel version that includes these fixes to avoid the boot crash caused by this vulnerability.

Description

CVE-2026-23474 is a vulnerability in the Linux kernel's mtd subsystem affecting the RedBoot partition table parser. The issue causes a boot crash due to a buffer overflow detected by the fortify source feature when parsing the partition table. The flaw arises from reading beyond the allocated buffer size during a memcmp operation, which is corrected by switching to strcmp to stay within bounds.

References

Community reviews

Loading reviews…