NetSight
IP …
medium5.5

CVE-2026-23285

In the Linux kernel, the following vulnerability has been resolved: drbd: fix null-pointer dereference on local read error In drbd_request_endio(), READ_COMPLE…

Impact

In the Linux kernel, the following vulnerability has been resolved: drbd: fix null-pointer dereference on local read error In drbd_request_endio(), READ_COMPLETED_WITH_ERROR is passed to __req_mod() with a NULL peer_device: __req_mod(req, what, NULL, &m); The READ_COMPLETED_WITH_ERROR handler then unconditionally passes this NULL peer_device to drbd_set_out_of_sync(), which dereferences it, causing a null-pointer dereference. Fix this by obtaining the peer_device via first_peer_device(device), matching how drbd_req_destroy() handles the same situation.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 6.4 before 6.6.130
from 6.7 before 6.12.77
from 6.13 before 6.18.17
from 6.19 before 6.19.7
Version 7.0

Weakness classification

CWE-476

References