LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23156: efivarfs: fix error propagation in efivar_entry_get()

In the Linux kernel, the following vulnerability has been resolved: efivarfs: fix error propagation in efivar_entry_get() efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors. This may result in uninitialized heap memory being copied to userspace in the efivarfs_file_read() path. Fix it by returning the error from __efivar_entry_get().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-23156 is a Linux kernel bug where a failed EFI variable read may still look successful. In that failure case, uninitialized kernel heap data could be returned to userspace through efivarfs. This is an information disclosure risk, not a documented remote takeover or active exploitation case in the provided sources.

Executive priority

Treat this as a normal-priority kernel information disclosure issue unless the affected systems are highly sensitive or broadly multi-user. Patch through standard kernel maintenance, with faster handling for shared servers or systems processing sensitive secrets.

Technical view

The flaw is in efivar_entry_get(), which masks failures from __efivar_entry_get(). In the efivarfs_file_read() path, that can result in uninitialized heap memory being copied to userspace. The Linux stable references fix this by returning the underlying error instead of success.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel versions with efivarfs available, typically UEFI-based systems exposing EFI variables. The provided affected-version data is limited and should be reconciled against distribution kernel packages and vendor advisories.

Exploitation context

The source bundle does not cite CISA KEV listing, active exploitation, public exploit code, or remote attack paths. Evidence only supports a kernel information disclosure condition through efivarfs reads when the underlying EFI variable get operation fails.

Researcher notes

Key uncertainty is exploitability. Sources identify uninitialized heap memory exposure to userspace but do not specify attacker privileges, required EFI variable state, reachable distributions, or CVSS. Avoid assuming remote impact. Validate against kernel commits and distro backports.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable fixes.
  • Check distribution advisories for backported patches and exact package versions.
  • Prioritize systems where efivarfs is mounted or EFI variables are exposed.
  • If patching is delayed, review vendor guidance for safe exposure reduction.

Validation and detection

  • Inventory Linux kernel versions across UEFI-capable systems.
  • Confirm whether efivarfs is present and mounted on relevant hosts.
  • Verify installed kernels include the efivar_entry_get() error propagation fix.
  • Track vendor advisories because affected-version mapping is incomplete.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23156 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2d82e6227ea189c0589e7383a36616ac2a2d248c, 2d82e6227ea189c0589e7383a36616ac2a2d248c, 2d82e6227ea189c0589e7383a36616ac2a2d248c, 2d82e6227ea189c0589e7383a36616ac2a2d248c, 2d82e6227ea189c0589e7383a36616ac2a2d248cunaffected
LinuxLinux6.0, 0, 6.1.162, 6.6.123, 6.12.69, 6.18.9, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.