CVE-2026-23028: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23028 is a memory leak vulnerability in the Linux kernel's LoongArch KVM implementation. Specifically, the kvm_ipi_destroy() function fails to free the kvm_device struct allocated during kvm_ioctl_create_device(), resulting in a resource leak. The vulnerability was published on January 31, 2026, and affects Linux kernel versions prior to 6.18.7 and 6.19-rc6. The CVSS category is estimated as Medium, with an EPSS score of approximately 0.018% (Red Hat Bugzilla, Feedly).

The root cause is a missing memory deallocation in the kvm_ipi_destroy() function within the LoongArch KVM subsystem of the Linux kernel (CWE-401: Missing Release of Memory after Effective Lifetime). When kvm_ioctl_create_device() allocates a kvm_device struct, the associated destroy() callback — kvm_ipi_destroy() — is expected to free that memory upon device teardown, but it does not do so. This results in a kernel memory leak each time a KVM IPI device is created and destroyed. Exploitation requires local access with privileges sufficient to invoke kvm_ioctl_create_device() (Red Hat Bugzilla, Kernel Fix 1, Kernel Fix 2).

An attacker with local privileges sufficient to create and destroy KVM devices could repeatedly trigger the memory leak, progressively exhausting kernel memory and causing denial of service through resource depletion on LoongArch systems running KVM. The impact is limited to availability — specifically system stability and KVM operational continuity — with no evidence of confidentiality or integrity compromise. The vulnerability is scoped to LoongArch architecture systems with KVM functionality enabled (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with KVM device creation privileges, significantly limiting the attack surface (Feedly).

Update the Linux kernel to version 6.18.7 or later (stable branch), or 6.19-rc6 or later (mainline). The fix is available via two upstream commits: 5defcc2f9c22 and 0bf58cb7288a. As a workaround on unpatched systems, restrict KVM device creation and destruction privileges to authorized users only, and monitor kernel memory usage for signs of progressive memory exhaustion on LoongArch KVM hosts (Red Hat Bugzilla, Feedly).