CVE-2026-23025: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23025 is a memory corruption vulnerability in the Linux kernel's per-cpu page allocator (pcp) subsystem, triggered by a spinlock nesting violation when the kernel is compiled with SMP=n (uniprocessor mode). The flaw was introduced by commit 574907741599 ("mm/page_alloc: leave IRQs enabled for per-cpu page allocations") and was first reported by the kernel test robot. It affects Linux kernel versions 6.1.57–6.1.161, 6.2.1–6.6.121, 6.7–6.12.66, 6.13–6.18.6, and release candidates up to 6.19-rc8. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper locking in the drain_pages_zone() function within mm/page_alloc.c (CWE-667: Improper Locking). When the kernel is built with SMP=n, the spinlock implementation assumes spin_trylock() will always succeed (it is effectively a no-op). However, the pcp locking scheme holds spin_lock(&pcp->lock) and then an interrupt fires, causing a nested spin_trylock() on the same lock — a scenario the SMP=n implementation cannot handle correctly. This results in potential corruption of the pcp structure. The fix introduces local wrapper functions (pcp_spin_lock_irqsave) that replace spin_lock() with spin_lock_irqsave() in all pcp lock sites when SMP=n is configured, preventing IRQ-driven nesting (Red Hat Bugzilla, Kernel Patch 1).

Successful exploitation can lead to kernel memory corruption of per-cpu page allocation structures, potentially enabling local privilege escalation from a low-privileged user to root. The vulnerability also poses risks of system instability and denial of service due to corrupted memory management structures. Given the kernel-level impact, a successful attacker could gain full control of the affected system, access sensitive data, and potentially pivot to other systems on the network (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and a kernel compiled with SMP=n, which limits the attack surface primarily to embedded or specialized uniprocessor Linux deployments (Red Hat Advisory).

Update to a patched Linux kernel version: 6.1.162 or later, 6.6.122 or later, 6.12.67 or later, or 6.18.7 or later. Patches have been committed to the Linux kernel stable trees (commits 038a102535eb, 3098f8f7c7b0, 4a04ff9cd816, 68688fc4eab0, df63d31e9ae0). As a temporary workaround where patching is not immediately possible, restrict local user access on systems running SMP=n kernels or consider recompiling the kernel with SMP=y if the hardware supports it. Ubuntu security notices USN-8278-1, USN-8289-1, USN-8296-1, and USN-8278-2 address this issue for Ubuntu users (Red Hat Bugzilla, Kernel Patch 1, Ubuntu USN-8278-1).