CVE-2026-23027: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23027 is a memory leak vulnerability in the Linux kernel's LoongArch KVM subsystem, specifically in the kvm_pch_pic_destroy() function. When kvm_ioctl_create_device() allocates memory for a kvm_device struct, the destroy() callback (kvm_pch_pic_destroy()) fails to free that memory, resulting in a kernel memory leak. The vulnerability was published on January 31, 2026, and affects Linux kernel versions prior to the patches applied in 6.18.7 and 6.19-rc6. It carries an estimated CVSS severity of Medium, with an EPSS score of approximately 0.018% (Red Hat Bugzilla, Feedly).

The root cause is a missing kfree() call in kvm_pch_pic_destroy() within the LoongArch KVM PCH PIC (Programmable Interrupt Controller) device emulation code, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). When a KVM device is created via kvm_ioctl_create_device(), memory is allocated for the kvm_device structure; however, the corresponding destroy() callback does not release this allocation, causing a kernel memory leak each time the device is destroyed. Exploitation would require local access to a system running a LoongArch-based KVM host. The fix was committed to the stable kernel tree at commits fc53a66227af and 1cf342a7c3ad (Red Hat Bugzilla, ENISA EUVD).

Successful exploitation of this vulnerability results in a kernel memory leak within the LoongArch KVM subsystem, gradually exhausting available kernel memory on affected hypervisor hosts. The primary impact is on availability — repeated device creation and destruction cycles could degrade or crash the host system over time. There is no direct confidentiality or integrity impact, and the vulnerability does not enable code execution or privilege escalation on its own (Red Hat Bugzilla).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2026-23027. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a LoongArch KVM host and the ability to repeatedly create and destroy KVM PCH PIC devices (Feedly).

The vulnerability is patched in Linux kernel versions 6.18.7 and 6.19-rc6, with fixes applied at commits fc53a66227af08d868face4b33fa8b2e1ba187ed and 1cf342a7c3adc5877837b53bbceb5cc9eff60bbf in the stable kernel tree. Administrators running LoongArch-based KVM hosts should update to a patched kernel version as soon as it is available from their distribution. No configuration-based workaround is known; upgrading the kernel is the recommended remediation (Red Hat Bugzilla, Feedly).