CVE-2026-23046: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23046 is a device mismatch bug in the Linux kernel's virtio_net driver involving improper use of devm_kzalloc and devm_kfree. Specifically, the initial allocation of rss_hdr uses virtio_device->device, while the subsequent free in virtnet_set_queues() incorrectly uses net_device->device, triggering a kernel devres warning. The vulnerability was published on February 4, 2026, and affects the Linux kernel. It carries an estimated CVSS severity of Medium, with an EPSS score of approximately 0.024% (Feedly).

The root cause is a device object mismatch in the virtio_net driver's managed resource handling (CWE-762: Mismatched Memory Management Routines). When rss_hdr is allocated via devm_kzalloc(virtio_device->device, ...), the kernel's devres subsystem associates the allocation with the virtio_device. However, virtnet_set_queues() later calls devm_kfree(net_device->device, ...), referencing a different device object, which causes the devres framework to fail to locate the allocation and emit a kernel warning (WARNING: drivers/base/devres.c:1095 at devm_kfree+0x84/0x98). The fix involves ensuring both allocation and deallocation reference the same device object. Patches are referenced in the Linux stable kernel tree (Feedly).

The primary impact is a kernel warning that can indicate memory management inconsistency, potentially leading to resource leaks or instability in systems running the affected virtio_net driver. In practice, the mismatch may cause the allocated memory to not be properly freed, resulting in a memory leak within the kernel's devres subsystem. Availability is the main concern, as repeated triggering could degrade system stability; confidentiality and integrity impacts are considered low for this class of bug (Feedly).

Apply the upstream Linux kernel patches that correct the device pointer used in devm_kfree within virtnet_set_queues() to match the virtio_device->device used during allocation. The fixes are available in the Linux stable kernel tree (commit references: a5e2d902f64c and acb4bc6e1ba3). Users should update to a patched kernel version as soon as it is available from their distribution vendor. No configuration-based workaround is known; avoiding use of the virtio_net driver in affected environments is the only interim mitigation (Feedly).