CVE-2026-23033: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23033 is a resource leak vulnerability in the Linux kernel's dmaengine: omap-dma driver. When either dma_async_device_register() or of_dma_controller_register() fails during the driver probe function, the dma_pool object created by dma_pool_create() is not properly destroyed, resulting in a memory resource leak in the error paths. The vulnerability was published on January 31, 2026, and affects Linux kernel versions from 3.6 onward, with fixes available in versions 6.6.122, 6.12.67, 6.18.7, and 6.19-rc6. No CVSS score has been formally assigned; the estimated severity is Medium (Feedly, Red Hat Bugzilla).

The root cause is improper resource cleanup (CWE-401: Missing Release of Memory after Effective Lifetime) in the omap-dma driver's probe function. When dma_async_device_register() or of_dma_controller_register() returns an error, the code exits without calling dma_pool_destroy() on the previously allocated dma_pool, leaving the memory unreleased. The fix adds explicit dma_pool_destroy() calls to both error paths to ensure proper cleanup. This is a local kernel-level issue with no network-facing attack surface; exploitation would require the ability to trigger repeated probe failures on affected hardware (Red Hat Bugzilla, Feedly).

The primary impact is a potential denial of service through memory exhaustion on systems using the OMAP DMA engine driver. If the probe function is invoked repeatedly with failures — for example, during hardware initialization retries — the unreleased dma_pool allocations accumulate over time, potentially degrading system stability or causing out-of-memory conditions. There is no known impact on confidentiality or integrity; the vulnerability is limited to availability on systems relying on the omap-dma driver (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability has an EPSS score of approximately 0.018% (0.000180), reflecting very low likelihood of exploitation. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to local contexts on systems with OMAP DMA hardware and requires conditions that trigger repeated probe failures (Feedly).

Update the Linux kernel to a patched version that includes the dma_pool_destroy() fix in the omap-dma driver error paths. Patched versions include Linux kernel 6.6.122, 6.12.67, 6.18.7, and 6.19-rc6 or later. Downstream distributions including Ubuntu (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-1/2, USN-8289-1/2, USN-8296-1/2, USN-8297-1) and SUSE (SUSE-2026-0962-1) have also released updated kernel packages. Systems not using OMAP DMA hardware are not affected (Red Hat Bugzilla, Feedly).