CVE-2026-23022: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23022 is a memory leak vulnerability in the Linux kernel's idpf (Infrastructure Data Path Function) network driver. The flaw exists in the idpf_vc_core_deinit() function, which fails to free the hw->lan_regs pointer during driver deinitialization, leaking 96 bytes of kernel memory per reset cycle. Affected versions include Linux kernel 6.17, 6.17.1 through 6.18.5, and 6.19-rc1 through 6.19-rc8. The vulnerability was published on January 31, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). During driver reset cycles, idpf_vc_core_init() allocates memory for hw->lan_regs via __kmalloc_noprof, but the corresponding deinitialization function idpf_vc_core_deinit() does not call the appropriate free routine for this pointer, resulting in a kernel memory leak. The leak was detected by the kernel's kmemleak subsystem, which reported an unreferenced 96-byte object allocated from the idpf_vc_core_init call path within a kernel worker thread (kworker/u258:14). Exploitation requires local access with low privileges, as the vulnerability is triggered through normal driver reset operations rather than external input (Red Hat Bugzilla, Feedly).

The primary impact is availability: repeated driver reset cycles cause 96 bytes of kernel memory to leak per cycle, which on long-running systems or those with frequent resets can lead to gradual memory exhaustion, degraded system performance, and potential denial of service conditions. There is no confidentiality or integrity impact, as the vulnerability does not expose sensitive data or allow unauthorized modification of system state. Systems running the idpf driver in high-availability or high-throughput network environments are most at risk (Feedly).

The vulnerability is fixed in Linux kernel version 6.18.6 and later, as well as in the 6.19-rc5 release candidate. Two specific upstream commits address the issue: 23391db8a00c23854915b8b72ec1aa10080aa540 and e111cbc4adf9f9974eed040aeece7e17460f6bff in the stable kernel repository. For systems that cannot be immediately updated, administrators should minimize driver reset cycles, monitor kernel memory usage for signs of exhaustion (e.g., via kmemleak or /proc/meminfo), and consider disabling the idpf driver if it is not actively required (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).