CVE-2026-23013: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23013 is a use-after-free vulnerability in the Linux kernel's octeon_ep_vf network driver, specifically in the IRQ handling code of octep_vf_request_irqs(). When request_irq() fails partway through MSI-X queue IRQ registration, the error rollback path calls free_irq() with a mismatched dev_id (oct instead of ioq_vector), leaving IRQ handlers registered against already-freed memory. The vulnerability affects Linux kernel versions 6.9.1 through 6.12.66 and 6.13 through 6.18.6, as well as 6.19 release candidates. It was published on January 25, 2026, with a CVSS v3.1 base score of 7.8 (High) per NIST NVD, and 7.0 (High) per kernel.org (Feedly, Red Hat Bugzilla).

The root cause is a use-after-free condition (CWE-416) in the octeon_ep_vf driver's IRQ registration error path. In octep_vf_request_irqs(), MSI-X queue IRQs are requested with dev_id set to ioq_vector; however, if request_irq() fails mid-loop, the rollback calls free_irq() with dev_id set to oct, which does not match the registered irqaction. This mismatch causes the kernel to fail to deregister the IRQ handler, leaving it alive while the ioq_vector structure is subsequently freed during unwind/teardown. When an interrupt fires after the structure is freed, the dangling handler accesses freed memory, triggering a use-after-free or kernel crash. Exploitation requires local access with low privileges and is contingent on triggering the specific error path during driver initialization or teardown (Feedly, Red Hat Bugzilla).

A local attacker with low privileges can trigger this vulnerability to cause kernel crashes, memory corruption, or undefined behavior, resulting in high impacts to confidentiality, integrity, and availability. The use-after-free condition occurs in kernel space, meaning successful exploitation could allow an attacker to corrupt kernel memory structures, potentially escalating privileges or causing a denial of service via system crash. The scope is limited to the local system, but kernel-level memory corruption may enable further lateral movement or privilege escalation within the affected host (Feedly).

The vulnerability is patched in Linux kernel versions 6.12.67 and later (for the 6.12.x branch) and 6.18.7 and later (for the 6.18.x branch), via commits aa05a8371ae4, aa4c066229b0, and f93fc5d12d69 (Feedly). Administrators should upgrade to a patched kernel version as the primary remediation. As a temporary workaround for systems that cannot be immediately upgraded, consider disabling the Octeon EP VF driver if it is not actively in use, or restricting local user access to minimize exposure. Monitor systems for unexpected kernel crashes or memory corruption errors that may indicate exploitation attempts.

Red Hat tracked the vulnerability via Bugzilla (Bug 2432668) and assigned it a medium severity rating. The upstream kernel advisory was referenced via the linux-cve-announce mailing list. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed for this CVE (Red Hat Bugzilla).