CVE-2026-23090: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23090 is a device reference leak vulnerability in the Linux kernel's slimbus (Serial Low-power Inter-chip Media Bus) core subsystem. When slimbus devices are allocated dynamically upon reception of report-present messages, the kernel fails to properly drop references taken when looking up already registered devices, leading to a persistent reference leak. The vulnerability was published on February 4, 2026, and affects Linux kernel versions from 4.16 through 6.18 across multiple stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium), with local attack vector and high availability impact (Feedly).

The root cause is improper reference counting (CWE-911: Improper Update of Reference Count) in the slimbus core subsystem (drivers/slimbus/core.c). When a report-present message is received, the kernel performs a device lookup that increments a reference counter; if the device is already registered, this reference is never decremented, causing a leak. The fix requires explicitly dropping the reference after a successful lookup of an already-registered device, and taking an extra reference when a new device must be allocated. Exploitation requires local access to trigger repeated report-present message handling, making the attack vector local with low privileges required (Feedly, Kernel Patch).

Successful exploitation allows a local attacker with low privileges to cause a denial-of-service condition by exhausting kernel memory through repeated triggering of the reference leak. Kernel objects remain allocated indefinitely, progressively consuming available kernel memory and ultimately leading to system instability or a crash. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges, limiting the practical attack surface primarily to multi-tenant or shared systems with slimbus hardware (Feedly).

Patches have been released across all affected Linux kernel stable branches. Administrators should update to the following minimum versions: 5.10.249 (for 4.16–5.10 branch), 5.15.199 (for 5.11–5.15 branch), 6.1.162 (for 5.16–6.1 branch), 6.6.122 (for 6.2–6.6 branch), 6.12.68 (for 6.7–6.12 branch), and 6.18.8 (for 6.13–6.18 branch). Distributions including Ubuntu (USN-8162-1, USN-8180-x, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1) and SUSE (SUSE-2026-0962-1) have issued advisories with updated packages. As a temporary workaround where patching is not immediately feasible, restricting local user access to slimbus interfaces can reduce exposure (Feedly, Ubuntu USN-8162-1, SUSE Advisory).

The vulnerability has been addressed through standard Linux kernel stable release processes, with multiple distribution vendors — including Ubuntu and SUSE — issuing security advisories and updated kernel packages. No notable independent researcher commentary or significant social media discussion has been observed, consistent with the moderate severity and limited exploitability of this issue (Ubuntu USN-8162-1, SUSE Advisory).