CVE-2026-23065: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23065 is a memory leak vulnerability in the Linux kernel's platform/x86/amd module, specifically within the wbrf_record() function. A temporary buffer allocated via kcalloc() is not freed when acpi_evaluate_dsm() fails, leaving memory unreleased in the error path (CWE-401). The vulnerability affects Linux kernel versions 6.8 through 6.12.67, 6.13 through 6.18.7, and 6.19 release candidates rc1–rc6. It was published on February 4, 2026, with patches released on March 13, 2026. The CVSS v3.1 base score is 5.5 (Medium) (Feedly, EUVD).

The root cause is a missing memory deallocation (CWE-401: Missing Release of Memory after Effective Lifetime) in the wbrf_record() function within platform/x86/amd of the Linux kernel. When acpi_evaluate_dsm() returns a failure, the function exits the error path without calling kfree() on the tmp buffer previously allocated with kcalloc(). The fix explicitly adds a kfree(tmp) call in the error handling path before returning. Exploitation requires local access with low privileges, as an attacker must be able to trigger the error path in acpi_evaluate_dsm() repeatedly to accumulate leaked memory (Feedly, Kernel Patch 1).

Successful exploitation leads to a gradual kernel memory leak, with no confidentiality or integrity impact. Repeated triggering of the vulnerable error path can exhaust available kernel memory, potentially causing denial of service through system performance degradation or complete unavailability when memory is depleted. The impact is limited to availability (rated High for that dimension), and there is no risk of data exposure or unauthorized modification (Feedly).

Update to a patched Linux kernel version: 6.12.68 or later (for the 6.12.x branch), 6.18.8 or later (for the 6.18.x branch), or 6.19-rc7 or later (for 6.19 release candidates). Three upstream kernel commits address this issue (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3). Distribution-specific updates are available from Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1, USN-8296-2, USN-8278-2, USN-8393-1) and SUSE (SUSE-2026-0962-1). As an interim measure, restrict local system access to trusted users only (Ubuntu Advisory, Feedly).

The vulnerability has received routine coverage from Linux distribution security teams, with Ubuntu and SUSE both issuing advisories and updated kernel packages. No notable researcher commentary or significant community discussion has been identified beyond standard patch tracking (Ubuntu Advisory, Feedly).