CVE-2026-23015: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23015 is a reference leak vulnerability in the Linux kernel's gpio_mpsse driver that can lead to a denial of service condition. The flaw exists in the gpio_mpsse_probe() function, where the USB device reference obtained via usb_get_dev() is not released when the probe encounters an error path. Affected versions include Linux kernel 6.13 through 6.18.5, as well as pre-release versions of 6.19 (rc1–rc8). It was published on January 31, 2026, with patches available by March 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Bugzilla, Feedly).

The root cause is a resource management error (CWE-401: Missing Release of Memory after Effective Lifetime) in the gpio_mpsse_probe() function of the Linux kernel's GPIO MPSSE USB driver. When the probe function encounters an error, it fails to call usb_put_dev() to release the reference acquired by usb_get_dev(), causing a reference count leak. The fix replaces manual reference management with device-managed helper functions (devm-style), which automatically release resources on device disconnection or probe failure, and removes the now-redundant usb_put_dev() call from the disconnect path. Exploitation requires local access and low privileges, as an attacker must be able to trigger repeated USB device attachment/detachment cycles or probe failures (Red Hat Bugzilla, Feedly).

Successful exploitation causes a gradual exhaustion of kernel memory resources as unreleased USB device references accumulate over repeated probe failures. This degrades system stability and availability, ultimately resulting in a denial of service condition where legitimate device operations may fail as the kernel's reference counter becomes exhausted. There is no impact on confidentiality or integrity; the vulnerability is limited to availability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, limiting the practical attack surface to scenarios where an adversary can physically connect or programmatically simulate USB MPSSE device attachment cycles.

The vulnerability is fixed in Linux kernel version 6.18.6 and later, as well as in the 6.19-rc5 pre-release. Patches are available at the upstream kernel repository (commits 1e876e5a0875e71e34148c9feb2eedd3bf6b2b43 and 7ea26e6dcabc270433b6ded2a1aee85b215d1b28). As a workaround, administrators should restrict physical USB device access to trusted users only and disable USB MPSSE device support if it is not required in their environment. Monitoring kernel memory usage and resource exhaustion alerts can help detect anomalous reference accumulation (Red Hat Bugzilla, Feedly).