CVE-2026-23081: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23081 is a reference count leakage vulnerability in the Linux kernel's net: phy: intel-xway driver. The flaw occurs when the driver checks for the existence of a leds child node in the device tree (OF node) without calling of_node_put() to release the reference, resulting in a kernel memory leak. It affects Linux kernel versions 6.13 through 6.18.7, as well as release candidates 6.19-rc1 through 6.19-rc6. The vulnerability was published on February 4, 2026, with patches released on March 18, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, EUVD).

The root cause is an improper reference count management (CWE-401: Missing Release of Memory after Effective Lifetime) in the intel-xway PHY driver. When the driver probes for the leds child node using OF (Open Firmware/device tree) APIs, it increments the node's reference count but fails to call of_node_put() to decrement it after the check, causing a persistent leak of kernel memory. The fix, identified via automated code review, adds the missing of_node_put() call to correctly maintain the refcount. Patch commits are available at git.kernel.org/stable/c/1f24dfd556401b75f78e8d9cbd94dd9f31411c3a and git.kernel.org/stable/c/79912b256e14054e6ba177d7e7e631485ce23dbe (Feedly).

Successful exploitation causes a denial-of-service condition through progressive kernel memory exhaustion. A local attacker with low privileges can repeatedly trigger the intel-xway PHY driver's LED node checking path, causing device tree node references to accumulate without being freed, ultimately leading to system instability or crashes. There is no impact on confidentiality or integrity; the vulnerability is limited to availability (Feedly).

Upgrade to Linux kernel version 6.18.8 or later, or apply the 6.19-rc7 (or subsequent) release candidate, which include the corrective patches. The specific fix commits are available at git.kernel.org/stable/c/1f24dfd556401b75f78e8d9cbd94dd9f31411c3a and git.kernel.org/stable/c/79912b256e14054e6ba177d7e7e631485ce23dbe. For systems that cannot be immediately patched, restrict local user access to interfaces involving the intel-xway PHY driver and monitor kernel memory usage for signs of gradual memory depletion (Feedly).