CVE-2026-23025: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23025 is a memory corruption vulnerability in the Linux kernel's per-cpu page allocator (pcp) subsystem, triggered by a spinlock nesting violation when the kernel is compiled with SMP=n (uniprocessor mode). The flaw was introduced by commit 574907741599 ("mm/page_alloc: leave IRQs enabled for per-cpu page allocations") and was first reported by the kernel test robot. It affects Linux kernel versions 6.1.57–6.1.161, 6.2.1–6.6.121, 6.7–6.12.66, 6.13–6.18.6, and release candidates up to 6.19-rc8. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper locking in the drain_pages_zone() function within mm/page_alloc.c (CWE-667: Improper Locking). When the kernel is built with SMP=n, the spinlock implementation assumes spin_trylock() will always succeed (it is effectively a no-op). However, the pcp locking scheme holds spin_lock(&pcp->lock) and then an interrupt fires, causing a nested spin_trylock() on the same lock — a scenario the SMP=n implementation cannot handle correctly. This results in potential corruption of the pcp structure. The fix introduces local wrapper functions (pcp_spin_lock_irqsave) that replace spin_lock() with spin_lock_irqsave() in all pcp lock sites when SMP=n is configured, preventing IRQ-driven nesting (Red Hat Bugzilla, Kernel Patch 1).

Successful exploitation can lead to kernel memory corruption of per-cpu page allocation structures, potentially enabling local privilege escalation from a low-privileged user to root. The vulnerability also poses risks of system instability and denial of service due to corrupted memory management structures. Given the kernel-level impact, a successful attacker could gain full control of the affected system, access sensitive data, and potentially pivot to other systems on the network (Red Hat Advisory, Red Hat Bugzilla).

Update to a patched Linux kernel version: 6.1.162 or later, 6.6.122 or later, 6.12.67 or later, or 6.18.7 or later. Patches have been committed to the Linux kernel stable trees (commits 038a102535eb, 3098f8f7c7b0, 4a04ff9cd816, 68688fc4eab0, df63d31e9ae0). As a temporary workaround where patching is not immediately possible, restrict local user access on systems running SMP=n kernels or consider recompiling the kernel with SMP=y if the hardware supports it. Ubuntu security notices USN-8278-1, USN-8289-1, USN-8296-1, and USN-8278-2 address this issue for Ubuntu users (Red Hat Bugzilla, Kernel Patch 1, Ubuntu USN-8278-1).