Riskcovery

CVE-2026-23156

efivarfs: fix error propagation in efivar_entry_get()

State
Published
Severity
Not scored
Published
Feb 14, 2026
Updated
May 11, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

efivarfs: fix error propagation in efivar_entry_get()

efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors.

This may result in uninitialized heap memory being copied to userspace in the efivarfs_file_read() path.

Fix it by returning the error from __efivar_entry_get().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 2d82e6227ea189c0589e7383a36616ac2a2d248c to before 3960f1754664661a970dc9ebbab44ff93a0b4c42Affected
  • 2d82e6227ea189c0589e7383a36616ac2a2d248c to before 510a16f1c5c1690b33504052bc13fbc2772c23f8Affected
  • 2d82e6227ea189c0589e7383a36616ac2a2d248c to before 89b8ca709eeeabcc11ebba64806677873a2787a8Affected
  • 2d82e6227ea189c0589e7383a36616ac2a2d248c to before e4e15a0a4403c96d9898d8398f0640421df9cb16Affected
  • 2d82e6227ea189c0589e7383a36616ac2a2d248c to before 4b22ec1685ce1fc0d862dcda3225d852fb107995Affected
LinuxLinux
  • 6.0Affected
  • before 6.0Not affected
  • 6.1.162 through 6.1.*Not affected
  • 6.6.123 through 6.6.*Not affected
  • 6.12.69 through 6.12.*Not affected
  • 6.18.9 through 6.18.*Not affected
  • 6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.