CVE-2026-23087: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23087 is a memory leak vulnerability in the Linux kernel's Xen SCSI backend (scsiback) driver. Memory allocated for struct vscsiblk_info during scsiback_probe() is not freed in scsiback_remove(), leading to resource leaks both on driver removal and in scsiback_probe() error paths. The vulnerability affects Linux kernel versions from 3.18 through multiple stable branches up to 6.18.x and 6.19 release candidates. It was published on February 4, 2026, with patches released on March 17, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the scsiback driver (drivers/xen/scsiback.c), the scsiback_probe() function allocates memory for a struct vscsiblk_info object, but the corresponding scsiback_remove() function fails to free this allocation, nor are error paths in scsiback_probe() handled correctly. The fix ensures that scsiback_remove() properly deallocates the structure, closing the leak on both normal removal and probe failure paths. Exploitation requires local access with low privileges — specifically the ability to load and unload the kernel module or trigger driver probe/remove cycles (Feedly, Kernel Patch).

The primary impact is on system availability. A local attacker with low privileges can repeatedly trigger driver removal cycles to cause incremental memory exhaustion, potentially degrading system performance and eventually leading to a denial-of-service condition through resource depletion. There is no confidentiality or integrity impact, as the vulnerability does not expose sensitive data or allow unauthorized modification of system state. The affected scope is limited to systems running the Xen SCSI backend driver (xen-scsiback) (Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, further limiting the practical attack surface (Feedly).

Apply the appropriate patched Linux kernel version for your branch:

• Kernel 3.18–5.10.x: update to 5.10.249 or later
• Kernel 5.11–5.15.x: update to 5.15.199 or later
• Kernel 5.16–6.1.x: update to 6.1.162 or later
• Kernel 6.2–6.6.x: update to 6.6.122 or later
• Kernel 6.7–6.12.x: update to 6.12.68 or later
• Kernel 6.13–6.18.x: update to 6.18.8 or later
• Kernel 6.19 RC: update to 6.19-rc7 or later

As an interim workaround, restrict local user access on systems running the xen-scsiback driver and monitor memory usage for anomalous growth. Ubuntu has issued multiple security notices (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1) addressing this vulnerability (Ubuntu USN-8180-1, Feedly).