CVE-2026-23023: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23023 is a memory leak vulnerability in the Linux kernel's idpf (Infrastructure Data Path Function) network driver. The flaw exists in the idpf_vport_rel() function, which fails to free the vport->rx_ptype_lkup memory allocation during vport release/reset operations. It affects Linux kernel versions 6.7 through 6.12.65, 6.13 through 6.18.5, and release candidates 6.19-rc1 through 6.19-rc8. The vulnerability was published on January 31, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). During driver reset operations, idpf_vport_rel() is called to clean up vport resources, but it omits freeing the vport->rx_ptype_lkup buffer that was allocated via __kmalloc_cache_noprof during idpf_send_get_rx_ptype_msg(). The leak was detected by the kernel's kmemleak tool, which reported an unreferenced 4096-byte object allocated in the idpf_init_task worker thread context. Exploitation requires local access with low privileges, as an attacker or process would need to trigger repeated driver reset cycles to accumulate leaked memory (Red Hat Bugzilla, Red Hat Advisory).

Each driver reset cycle leaks 4096 bytes of kernel memory that is never reclaimed, and repeated resets can progressively exhaust available kernel memory, ultimately leading to a denial of service condition. There is no confidentiality or integrity impact — the vulnerability is limited to availability (HIGH availability impact per CVSS). The scope is confined to the local system running the affected idpf driver, with no known potential for lateral movement or data exposure (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Red Hat Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, further limiting the practical attack surface.

• Logs: Kernel kmemleak reports of unreferenced objects allocated by idpf_send_get_rx_ptype_msg or idpf_init_task; dmesg entries showing repeated idpf driver reset events.
• System Behavior: Gradual, unexplained decrease in available kernel memory on systems using the idpf network driver, particularly following network adapter resets or driver reload cycles.
• Process: Worker threads (kworker) associated with the idpf module showing repeated initialization cycles in process listings or kernel traces.

Upgrade to a patched Linux kernel version: 6.12.66 or later, 6.18.6 or later, or 6.19-rc5 or later. Patch commits are available at git.kernel.org with IDs a4212d6732e3f674c6cc7d0b642f276d827e8f94, ec602a2a4071eb956d656ba968c58fee09f0622d, and f6242b354605faff263ca45882b148200915a3f6. As a temporary workaround prior to patching, minimize driver reset operations on systems using the idpf driver and monitor kernel memory usage for signs of progressive exhaustion (Red Hat Bugzilla, Red Hat Advisory).