CVE-2026-23474

Vulnerability

CVE-2026-23474 describes a buffer overread in the Linux kernel's RedBoot partition table parser (mtd). When CONFIG_FORTIFY_SOURCE=y is set with a recent compiler, the aggressive bounds checking now raises a memcmp: detected buffer overflow warning, followed by a kernel oops during boot [1]. The root cause is that the code uses memcmp() with a namelen length argument that can be up to 14 bytes, but the destination pointer names only points into an allocation of size 14 (the total available space). As explained in the commit message, `'names' is pointing to the final 'namelen' many bytes of the allocation ... 'namelen' could be basically any length at all. This fortify warning looks legit to me -- this code used to be reading beyond the end of the allocation.'

Exploitation

This vulnerability is triggered during normal boot when the kernel parses the RedBoot partition table from flash. No special privileges or authentication are required, as it occurs in the early boot path before userspace is available. An attacker who can control the partition table data on flash (e.g., via physical access or a previous compromise) could potentially craft a malicious table to induce the overread, though the primary impact is a denial of service from the crash.

Impact

The immediate consequence is a kernel crash (oops) that prevents the system from booting. While the overread may not allow data exfiltration or privilege escalation in the common case, a denial-of-service condition is reliably triggered on systems with RedBoot partition tables when the fortified kernel is used.

Mitigation

The fix has been applied in the Linux kernel stable tree [1][2][3][4] and replaces the unsafe memcmp() with strcmp(), which naturally stops at a null terminator and thus stays within the allocated buffer. Users should update to a kernel version containing the patch or backport the change. No workaround is available for unpatched kernels; disabling CONFIG_FORTIFY_SOURCE would avoid the crash but would remove a valuable security hardening feature.