Linux: Use of Uninitialized Resource
CVE-2026-23317 is a high-severity use of uninitialized resource vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions ce3a5cf139787c186d5d54336107298cacaad2b9, 7e55d0788b362c93660b80cc5603031bbbdefa98, 36cb28b6d303a81e6ed4536017090e85e0143e42 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.14% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to ce3a5cf139787c186d5d54336107298cacaad2b9 or 7e55d0788b362c93660b80cc5603031bbbdefa98 or 36cb28b6d303a81e6ed4536017090e85e0143e42 or 531f45589787799aa81b63e1e1f8e71db5d93dd1, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.1.167 or 6.6.130 or 6.12.77 or 6.18.17, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 7ac9578e45b20e3f3c0c8eb71f5417a499a7226a up to, but not including, ce3a5cf139787c186d5d54336107298cacaad2b9; a309c7194e8a2f8bd4539b9449917913f6c2cd50 up to, but not including, 7e55d0788b362c93660b80cc5603031bbbdefa98; a309c7194e8a2f8bd4539b9449917913f6c2cd50 up to, but not including, 36cb28b6d303a81e6ed4536017090e85e0143e42; a309c7194e8a2f8bd4539b9449917913f6c2cd50 up to, but not including, 531f45589787799aa81b63e1e1f8e71db5d93dd1; a309c7194e8a2f8bd4539b9449917913f6c2cd50 up to, but not including, 149f028772fa2879d9316b924ce948a6a0877e45; a309c7194e8a2f8bd4539b9449917913f6c2cd50 up to, but not including, 5023ca80f9589295cb60735016e39fc5cc714243; 6.1.7 up to, but not including, 6.1.167; 6.2 | ce3a5cf139787c186d5d54336107298cacaad2b9, 7e55d0788b362c93660b80cc5603031bbbdefa98, 36cb28b6d303a81e6ed4536017090e85e0143e42, 531f45589787799aa81b63e1e1f8e71db5d93dd1, 149f028772fa2879d9316b924ce948a6a0877e45, 5023ca80f9589295cb60735016e39fc5cc714243 |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | all versions | Not stated |
| Linux | Linux Kernel | 6.1.7 up to, but not including, 6.1.167; 6.2.1 up to, but not including, 6.6.130; 6.7 up to, but not including, 6.12.77; 6.13 up to, but not including, 6.18.17; 6.19 up to, but not including, 6.19.7; 6.2; 7.0 | 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another lookup function that returned an error code with the pointer becoming an out parameter. The error path when the lookup failed was not changed to reflect this change and the code continued to return the PTR_ERR of the now uninitialized pointer. This could cause the vmw_translate_ptr functions to return success when they actually failed causing further uninitialized and OOB accesses.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How developers prevent this class of flaw
- Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
- Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
- Avoid race conditions (CWE-362) during initialization routines.
More Use of Uninitialized Resource vulnerabilities (CWE-908)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/149f028772fa2879d9316b924ce948a6a0877e45
- git.kernel.org/stable/c/36cb28b6d303a81e6ed4536017090e85e0143e42
- git.kernel.org/stable/c/5023ca80f9589295cb60735016e39fc5cc714243
- git.kernel.org/stable/c/531f45589787799aa81b63e1e1f8e71db5d93dd1
- git.kernel.org/stable/c/7e55d0788b362c93660b80cc5603031bbbdefa98
- git.kernel.org/stable/c/ce3a5cf139787c186d5d54336107298cacaad2b9
Other references
Recent Use of Uninitialized Resource vulnerabilities
- 9.1 Critical severity
- 9.1 Critical severity
- 7.5 High severity
- 8.8 High severity
- 7.5 High severity
- 7.5 High severity
Spotted an error? Tell us.