CVE-2026-23024: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23024 is a memory leak vulnerability in the Linux kernel's idpf (Intel Data Plane Function) driver affecting the flow steering list cleanup during module removal. When the idpf kernel module is removed while active flow steering rules exist (created via ethtool), the list entries are not properly freed, resulting in a memory leak. The vulnerability was published on January 31, 2026, and affects Linux kernel versions 6.17 through 6.18.5 and 6.19-rc1 through 6.19-rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Bugzilla, Red Hat CVE).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime): the idpf driver's module removal path (rmmod) fails to iterate through and free remaining entries in the flow steering list when active ethtool-managed flow steering rules are present. The fix involves adding cleanup logic during module teardown to iterate through all remaining list entries and free associated memory, as well as introducing a spinlock (flow_steer_list_lock) to protect concurrent list access from multiple threads. Exploitation requires local access with low privileges — an attacker or unprivileged user can trigger the leak by creating flow steering rules via ethtool and then repeatedly loading/unloading the idpf module (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation leads to progressive memory exhaustion on systems where the idpf module is loaded and unloaded with active flow steering rules. Over repeated module cycles, the accumulated memory leak can cause system instability, degraded performance, or a denial of service through resource exhaustion. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS availability impact: High) (Red Hat CVE).

Upgrade the Linux kernel to version 6.18.6 or 6.19-rc5 (or later) to obtain the fix, which is addressed by commits 1aedff70a5e97628eaaf17b169774cb6a45a1dc5 and f9841bd28b600526ca4f6713b0ca49bf7bb98452. For systems that cannot immediately update, minimize or avoid repeated idpf module load/unload cycles while active flow steering rules are configured. Monitor system memory usage for signs of gradual exhaustion, and consider implementing resource limits to contain the impact (Red Hat Bugzilla, Red Hat CVE).