{"id":"AZL-80580","summary":"CVE-2026-23285 affecting package kernel for versions less than 6.6.130.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrbd: fix null-pointer dereference on local read error\n\nIn drbd_request_endio(), READ_COMPLETED_WITH_ERROR is passed to\n__req_mod() with a NULL peer_device:\n\n  __req_mod(req, what, NULL, &m);\n\nThe READ_COMPLETED_WITH_ERROR handler then unconditionally passes this\nNULL peer_device to drbd_set_out_of_sync(), which dereferences it,\ncausing a null-pointer dereference.\n\nFix this by obtaining the peer_device via first_peer_device(device),\nmatching how drbd_req_destroy() handles the same situation.","modified":"2026-08-28T17:46:32.769411851Z","published":"2026-03-25T11:16:23Z","upstream":["CVE-2026-23285"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23285"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.130.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-80580.json"}}],"schema_version":"1.9.0"}