CVE-2026-23029: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23029 is a memory leak vulnerability in the Linux kernel's LoongArch KVM subsystem, specifically in the kvm_eiointc_destroy() function. When kvm_ioctl_create_device() allocates memory for a kvm_device struct, the destroy() callback (kvm_eiointc_destroy()) fails to free that memory, resulting in a kernel memory leak. The vulnerability was published on January 31, 2026, and affects Linux kernel versions prior to the patches applied in 6.18.7 and 6.19-rc6. It carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.018% (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing memory deallocation in kvm_eiointc_destroy() within the LoongArch KVM driver (CWE-401: Missing Release of Memory after Effective Lifetime). When a KVM device is created via kvm_ioctl_create_device(), memory is allocated for the kvm_device structure; however, the corresponding destroy() callback for the EIOINTC device type does not call kfree() on this structure before returning, leaving the allocation unreleased. Exploitation requires local access to a system running a vulnerable kernel on LoongArch hardware with KVM enabled, and the ability to invoke the KVM_CREATE_DEVICE ioctl. Patches were committed to the stable kernel tree at commits 7d8553fc75ae and e94ec9661c58 (Red Hat Bugzilla).

The primary impact is a kernel memory leak, which can gradually exhaust available kernel memory on affected LoongArch systems running KVM workloads. Repeated triggering of the vulnerable code path could degrade system performance or contribute to denial-of-service conditions over time. There is no direct evidence of confidentiality or integrity compromise; the vulnerability does not enable code execution or privilege escalation on its own (Red Hat Advisory).

There are no known public exploits, exploit kits, or reports of in-the-wild exploitation for CVE-2026-23029. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited to local attackers with access to LoongArch hardware running a vulnerable Linux kernel with KVM enabled (Red Hat Advisory).

The fix has been applied to Linux kernel stable branches in versions 6.18.7 and 6.19-rc6 via commits 7d8553fc75aefa7ec936af0cf8443ff90b51732e and e94ec9661c5820d157d2cc4b6cf4a6ab656a7b4d. Users running LoongArch systems with KVM should update to a patched kernel version as soon as it is available from their distribution. No configuration-based workaround is documented; disabling KVM on affected systems would prevent exposure if patching is not immediately possible (Red Hat Bugzilla).