CVE-2026-23094: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23094 is a denial-of-service vulnerability in the Linux kernel's uacce (Unified/User-space Accelerator Framework) subsystem caused by improper validation of sysfs callback functions in the device isolation feature. It was published on February 4, 2026, and affects Linux kernel versions 6.3 through 6.6.121, 6.7 through 6.12.67, and 6.13 through 6.18.7, as well as pre-release versions 6.19-rc1 through 6.19-rc6. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper validation (CWE-476 / null pointer dereference) in the uacce driver's sysfs file creation logic. The uacce subsystem creates sysfs files for isolation error threshold configuration if either the isolate_err_threshold_read or isolate_err_threshold_write callback function is present in the driver; however, when a user accesses the sysfs interface and the corresponding callback does not exist, the kernel attempts to call a null function pointer, causing a system crash. A local attacker with low privileges can trigger this condition by reading or writing to the relevant sysfs path when only one of the two callbacks is implemented by the underlying hardware driver (Feedly).

Successful exploitation results in a kernel crash, causing a complete denial of service on the affected system. The impact is limited to availability (rated High), with no confidentiality or integrity impact. Because the attack requires only local access with low privileges, any unprivileged user on a system running a vulnerable kernel with uacce-enabled hardware accelerators could bring down the system (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term (Feedly).

The Linux kernel maintainers have released patches addressing this issue across all affected stable branches. Users should update to the following patched versions or later: 6.6.122, 6.12.68, 6.18.8, or 6.19-rc7. The fixes are available as four separate stable-tree commits (Feedly). Downstream distributions including SUSE and Ubuntu have also issued updated kernel packages incorporating this fix (SUSE Advisory, Ubuntu Advisory). As a temporary workaround where patching is not immediately possible, restrict local user access and limit privileges on systems running vulnerable kernels with uacce-enabled hardware.