CVE-2026-23026: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23026 is a memory leak vulnerability in the Linux kernel's DMA engine Qualcomm GPI (General Purpose Interface) driver, specifically within the gpi_peripheral_config() function. It was published on January 31, 2026, and affects Linux kernel versions from 5.11.1 through multiple stable branches up to 6.18.x. The flaw was discovered via static analysis and code review. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In gpi_peripheral_config(), when krealloc() is called to resize the buffer pointed to by gchan->config and fails, it returns NULL. The function then directly assigns this NULL to gchan->config, overwriting the pointer to the previously allocated memory without freeing it first. This causes the original memory block to become unreachable and permanently leaked. The fix involves using a temporary variable to capture the krealloc() return value and only updating gchan->config if the allocation succeeds (Red Hat Bugzilla, Feedly).

Successful exploitation allows a local attacker with low privileges to repeatedly trigger the failed krealloc() condition, causing cumulative memory leaks without any memory being released. Over time, this leads to memory exhaustion, resulting in denial of service through system performance degradation and potential system instability. There is no impact on confidentiality or integrity; the vulnerability is limited to availability (Red Hat CVE).

Update the Linux kernel to one of the following patched versions: 5.15.199 or later (for the 5.11.1–5.15.x branch), 6.1.162 or later (for 5.16–6.1.x), 6.6.122 or later (for 6.2–6.6.x), 6.12.67 or later (for 6.7–6.12.x), or 6.18.7 or later (for 6.13–6.18.x). Patch commits are available at the upstream kernel repository. Systems that do not use the Qualcomm GPI DMA driver (i.e., non-Qualcomm SoC platforms) are not affected. Ubuntu and SUSE have issued corresponding security advisories and updated packages (Red Hat CVE, Ubuntu USN-8162-1, SUSE Advisory).

Red Hat tracked the issue via Bugzilla (Bug 2435656) and assigned it a medium severity rating. Ubuntu issued multiple security notices (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-1/2, USN-8289-1/2, USN-8296-1/2, USN-8297-1, USN-8393-1) addressing this and related kernel vulnerabilities. SUSE also published an advisory (SUSE-2026:0962-1). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability (Red Hat Bugzilla, Ubuntu USN-8162-1, SUSE Advisory).