{
  "public_date" : "2026-04-03T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: mtd: Avoid boot crash in RedBoot partition table parser",
    "id" : "2454806",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2454806"
  },
  "cwe" : "CWE-805",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nmtd: Avoid boot crash in RedBoot partition table parser\nGiven CONFIG_FORTIFY_SOURCE=y and a recent compiler,\ncommit 439a1bcac648 (\"fortify: Use __builtin_dynamic_object_size() when\navailable\") produces the warning below and an oops.\nSearching for RedBoot partition table in 50000000.flash at offset 0x7e0000\n------------[ cut here ]------------\nWARNING: lib/string_helpers.c:1035 at 0xc029e04c, CPU#0: swapper/0/1\nmemcmp: detected buffer overflow: 15 byte read of buffer size 14\nModules linked in:\nCPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0 #1 NONE\nAs Kees said, \"'names' is pointing to the final 'namelen' many bytes\nof the allocation ... 'namelen' could be basically any length at all.\nThis fortify warning looks legit to me -- this code used to be reading\nbeyond the end of the allocation.\"\nSince the size of the dynamic allocation is calculated with strlen()\nwe can use strcmp() instead of memcmp() and remain within bounds.", "A flaw was found in the Linux kernel's Memory Technology Device (mtd) subsystem, specifically within the RedBoot partition table parser. A local user could trigger a buffer overflow when the system attempts to read beyond the allocated buffer size during partition table parsing. This vulnerability can lead to a system boot crash, resulting in a Denial of Service (DoS)." ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-23474\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23474\nhttps://lore.kernel.org/linux-cve-announce/2026040323-CVE-2026-23474-e350@gregkh/T" ],
  "name" : "CVE-2026-23474",
  "csaw" : false
}