CVE-2026-23091: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23091 is a memory leak vulnerability in the Linux kernel's intel_th (Intel Trace Hub) driver, classified under CWE-401 (Missing Release of Memory after Effective Lifetime). The flaw causes device references acquired during output device open() operations to not be properly released on certain error paths and on successful open, allowing references to accumulate over time. It affects Linux kernel versions from 4.4 up to (but not including) 5.10.249, 5.11–5.15.199, 5.16–6.1.162, 6.2–6.6.122, 6.7–6.12.68, and 6.13–6.18.8, as well as release candidates 6.19-rc1 through 6.19-rc6. The vulnerability was published on February 4, 2026, with patches released on March 17, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper reference counting in the intel_th driver's output device open() function (CWE-401). When the driver looks up the Intel Trace Hub (th) device during an open() call, it takes a reference that must be released on both error and close paths. A prior commit addressed some error-path leaks but missed others, and the reference also leaks on the successful open() path — meaning every successful open permanently increments the reference count without a corresponding release on close(). A local, low-privileged user with access to the intel_th output device node can repeatedly open the device to accumulate unreleased references, gradually exhausting kernel memory (Feedly, Kernel Patch).

Exploitation leads exclusively to an availability impact — there is no confidentiality or integrity compromise. A low-privileged local attacker can trigger progressive kernel memory exhaustion by repeatedly opening the intel_th output device, resulting in system instability, performance degradation, and potential kernel panic or system crash. The impact is limited to the local system where the intel_th driver is loaded; lateral movement or data exfiltration are not applicable to this vulnerability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and no user interaction, limiting the practical attack surface to multi-tenant or shared systems where the intel_th driver is active (Feedly).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing repeated intel_th device open events without corresponding close events; kernel warnings related to memory pressure or reference count anomalies in the intel_th subsystem.
• System Behavior: Gradual increase in kernel memory usage (/proc/meminfo showing declining MemFree/MemAvailable) without a clear application-level cause; system sluggishness or OOM (Out-of-Memory) killer events.
• Process: Unusual or repeated access to /dev/intel_th* device nodes by low-privileged processes.

Apply kernel updates to reach the following minimum patched versions: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, or 6.18.8 (depending on the branch in use). Multiple stable kernel commits address this issue across all affected branches (Kernel Patch, Feedly). As a workaround for systems that cannot be updated immediately, consider blacklisting the intel_th kernel module (echo 'blacklist intel_th' >> /etc/modprobe.d/blacklist.conf) if Intel Trace Hub functionality is not required. Restrict local user access to /dev/intel_th* device nodes as an additional mitigation. Downstream distributions including Ubuntu (USN-8162-1, USN-8180-x, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1), SUSE, and Oracle Linux have also released updated kernel packages (Ubuntu Advisory, SUSE Advisory).