Intel

CVE-2026-23474

Siemens ProductCERT Advisory SSA-019113

mediumEPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: mtd: Avoid boot crash in RedBoot partition table parser Given CONFIG_FORTIFY_SOURCE=y and a recent compiler, commit 439a1bcac648 ("fortify: Use __builtin_dynamic_object_size() when available") produces the warning below and an oops. Searching for RedBoot partition table in 50000000.flash at offset 0x7e0000 ------------[ cut here ]------------ WARNING: lib/string_helpers.c:1035 at 0xc029e04c, CPU#0: swapper/0/1 memcmp: detected buffer overflow: 15 byte read of buffer size 14 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0 #1 NONE As Kees said, "'names' is pointing to the final 'namelen' many bytes of the allocation ... 'namelen' could be basically any length at all. This fortify warning looks legit to me -- this code used to be reading beyond the end of the allocation." Since the size of the dynamic allocation is calculated with strlen() we can use strcmp() instead of memcmp() and remain within bounds.

Source: DEBIAN_DSADEBIAN_DSASIEMENS_ADVISORYSIEMENS_ADVISORYUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNBSIBSI_CSAFUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNCVELISTV5NVDEUVDCVEORG

Metrics

Severity
medium
Priority score
217.94
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
5.5
Source: nvd-v3
CVSS v3
5.5
CVSS v4
—
EPSS percentile
3.8 %
Low — this CVE sits in the lower 10% of all CVEs scored today.
EPSS score
0.1 %
Low — model estimates < 1% exploitation likelihood.
Published
2021-09-26 00:00 UTC
CWE
—

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Translated2026-07-24 22:10 UTC· nvd@nist.gov
    • Translation: Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: mtd: Evitar un fallo de arranque en el analizador de tablas de particiones RedBoot Dado CONFIG_FORTIFY_SOURCE=y y un compilador reciente, el commit 439a1bcac648 ('fortify: Usar __builtin_dynamic_object_size() cuando esté disponible') produce la advertencia a continuación y un oops. Buscando la tabla de particiones RedBoot en 50000000.flash en el desplazamiento 0x7e0000 ------------[ cut here ]------------ WARNING: lib/string_helpers.c:1035 at 0xc029e04c, CPU#0: swapper/0/1 memcmp: detectó desbordamiento de búfer: lectura de 15 bytes de un búfer de tamaño 14 Módulos enlazados: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 No contaminado 6.19.0 #1 NONE Como dijo Kees, ''names' está apuntando a los 'namelen' bytes finales de la asignación ... 'namelen' podría ser básicamente de cualquier longitud.' Esta advertencia de fortify me parece legítima -- este código solía leer más allá del final de la asignación. Dado que el tamaño de la asignación dinámica se calcula con strlen(), podemos usar strcmp() en lugar de memcmp() y permanecer dentro de los límites.

Affected operating systems

  • linux

    amazon / amazon_linux

  • linux

    ubuntu / awsbionic

  • linux

    ubuntu / awsjammy

  • linux

    ubuntu / awsnoble

  • linux

    ubuntu / awsresolute

  • linux

    ubuntu / awsxenial

  • linux

    ubuntu / aws-6.8jammy

  • linux

    ubuntu / aws-hwexenial

  • linux

    ubuntu / azurejammy

  • linux

    ubuntu / azurenoble

  • linux

    ubuntu / azureresolute

  • linux

    ubuntu / azurexenial

  • linux

    ubuntu / azure-4.15bionic

  • linux

    suse / basesystem_module15

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    debian / debian_linux13.0

  • linux

    suse / development_tools_module15

  • linux

    redhat / enterprise_linux10.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • linux

    redhat / enterprise_linux_aus8.4

  • linux

    redhat / enterprise_linux_aus8.6

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • arista

    cloudvision_agni2024.4.0 – 2025.2.2

  • arista

    cloudvision_portal2024.2.0 – 2026.1.0

  • arista

    velocloud_edge4.5.0 – 6.4.1

  • arista

    velocloud_gateway

  • arista

    velocloud_orchestrator

  • canonical

    ubuntu_linux

  • Citrix Systems

    Hypervisor8.2 CU1 LTSR

  • Citrix Systems

    XenServer8.4

  • Dell

    ECS3.8.1.0-3.8.1.7

  • Dell

    NetWorkerVirtual Edition

  • Dell

    NetWorkervProxy 19.13.0.3

  • Dell

    NetWorkervProxy 19.14

  • Dell

    PowerScale OneFS13.2.3

  • Dell

    PowerScale OneFSOneFS

  • Dell

    Secure Connect GatewayAppliance 5.32.00.18

  • gnupg

    libgcrypt1.11.0 – 1.11.3

  • gnupg

    libgcrypt1.12.0 – 1.12.2

  • gnupg

    libgcrypt1.8.8 – 1.10.4

  • Intel

    ProzessorCore Ultra 5

  • Intel

    ProzessorCore Ultra 7

  • Intel

    ProzessorCore Ultra 9

  • julia

    openssh_jll

  • netapp

    active_iq_unified_manager

  • netapp

    clustered_data_ontap

References & sources

Linked CVEs

Show 406 more CVEs
IDCVE-2026-23474
Siemens ProductCERT Advisory SSA-019113 — CVE-2026-23474 | NEOSEC Intel