CVE-2026-23079: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23079 is a memory leak vulnerability in the Linux kernel's GPIO character device (cdev) subsystem, specifically in the lineinfo_changed_notify() function, which fails to release allocated resources on error handling paths. It affects Linux kernel versions 6.17.10 through 6.18 (excluding 6.18) and 6.18.1 through 6.18.8 (excluding 6.18.8), as well as release candidates 6.19-rc1 through 6.19-rc6. The vulnerability was published on February 4, 2026, with patches released on March 18, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the gpio/cdev subsystem, the lineinfo_changed_notify() function allocates resources but does not free them when error conditions are encountered during execution, resulting in kernel memory leaks. Exploitation requires local access with low privileges to trigger the error paths in this function. Two fix commits have been published to the Linux stable repository: 16414341b0dd58b650b5df45c79115bc5977bb76 and 70b3c280533167749a8f740acaa8ef720f78f984 (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation allows a local, low-privileged attacker to cause kernel memory leaks by repeatedly triggering error conditions in lineinfo_changed_notify(). Over time, this can exhaust available kernel memory, leading to system instability or an unresponsive state — a denial of service condition. There is no impact on confidentiality or integrity; the vulnerability is limited to availability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Upgrade to Linux kernel version 6.18.8 or later for the 6.18.x stable series, or to 6.19-rc7 or later for release candidates. Two upstream fix commits are available in the Linux stable repository: 16414341b0dd58b650b5df45c79115bc5977bb76 and 70b3c280533167749a8f740acaa8ef720f78f984. As a configuration-based mitigation, administrators should restrict access to GPIO cdev interfaces where possible and monitor systems for abnormal kernel memory consumption (Feedly, Kernel Patch 1, Kernel Patch 2).