CVE-2026-23123: interconnect: debugfs: initialize src_node and dst_node to empty strings
In the Linux kernel, the following vulnerability has been resolved:
interconnect: debugfs: initialize srcnode and dstnode to empty strings
The debugfscreatestr() API assumes that the string pointer is either NULL or points to valid kmalloc() memory. Leaving the pointer uninitialized can cause problems.
Initialize srcnode and dstnode to empty strings before creating the debugfs entries to guarantee that reads and writes are safe.
Affected Software
Remediation
Event History
Frequently Asked Questions
Can this be exploited remotely?
No. The CVSS vector identifies the attack vector as local, and exploitation requires low privileges; no user interaction is required.
What is the expected security impact?
The stated impact is high availability impact, with no confidentiality or integrity impact. The issue can make debugfs entry reads or writes unsafe.
What remediation is available?
A patch is available. Apply the applicable Linux kernel stable patch referenced in the advisory.