CVE-2026-23021: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23021 is a memory leak vulnerability in the Linux kernel's USB Pegasus network driver, specifically in the update_eth_regs_async() function. When asynchronously writing to device registers, if usb_submit_urb() fails, the code does not release previously allocated resources, resulting in a kernel memory leak. The vulnerability was published on January 31, 2026, and affects Linux kernel versions from 3.10.1 through multiple stable branches up to 6.18.x and 6.19 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the update_eth_regs_async() function of the drivers/net/usb/pegasus.c driver, resources (such as URB and associated buffers) are allocated before calling usb_submit_urb(). If usb_submit_urb() returns an error, the error-handling path fails to free those resources, causing a kernel memory leak. Exploitation requires local access with low privileges, as an attacker must be able to trigger the asynchronous register update path — for example, by manipulating network interface settings on a system with a Pegasus USB-to-Ethernet adapter attached (Red Hat CVE, Feedly).

Repeated triggering of the memory leak can exhaust kernel memory, leading to denial of service through system instability or crash. There is no confidentiality or integrity impact — the vulnerability is limited to availability (high). The affected scope is confined to the local system running a vulnerable kernel with a Pegasus USB network device, with no known potential for lateral movement or data exfiltration (Red Hat CVE, Feedly).

Patches have been released for all affected stable kernel branches. The fixed versions are: 5.10.248, 5.15.198, 6.1.161, 6.6.121, 6.12.66, and 6.18.6; patches for 6.19 are included from rc5 onward. Administrators should update to the appropriate patched kernel version for their distribution. As a workaround where patching is not immediately possible, restricting local user access and avoiding attachment of Pegasus USB network devices reduces the attack surface. Distributions including Ubuntu, SUSE, Oracle Linux, and Amazon Linux 2 have issued their own kernel update advisories incorporating these fixes (Red Hat CVE, Ubuntu USN-8278-1, Feedly).