Improper locking in Linux kernel - CVE-2026-23199

Vulnerability identifier: #VU122904

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-23199

CWE-ID: CWE-667

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the get_build_id_64(), __build_id_parse() and build_id_parse_nofault() functions in lib/buildid.c. A local user can perform a denial of service (DoS) attack.

Linux kernel
Debian Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
kernel (Red Hat package)
linux (Debian package)

Install update from vendor's repository.

kernel (Red Hat package) - update to 6.12.0-211.43.1.el10_2
linux (Debian package) - update to 6.12.73-1

• https://git.kernel.org/stable/c/b5cbacd7f86f4f62b8813688c8e73be94e8e1951
• https://git.kernel.org/stable/c/b9b97e6aeb534315f9646b2090d1a5024c6a4e82
• https://git.kernel.org/stable/c/cbc03ce3e6ce7e21214c3f02218213574c1a2d08

• Improper locking in Linux kernel lib
• Debian update for linux
• Red Hat Enterprise Linux 10 update for kernel