CVE-2026-23133: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23133 is a memory management flaw in the Linux kernel's ath10k WiFi driver caused by incorrect pointer usage during DMA buffer deallocation. Specifically, dma_free_coherent() is called with aligned addresses instead of the correct unaligned addresses stored in XXX_unaligned fields by dma_alloc_coherent(). The vulnerability affects Linux kernel versions from 4.16 up to (but not including) 5.10.249, 5.11–5.15.199, 5.16–6.1.162, 6.2–6.6.122, 6.7–6.12.68, and 6.13–6.18.8, as well as pre-release 6.19-rc1 through rc6. It was published on February 14, 2026, with patches released on March 17, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper pointer management (CWE-119/CWE-401 — improper memory handling) in the ath10k driver's DMA buffer lifecycle. When dma_alloc_coherent() allocates a DMA-mapped buffer, it stores the original (unaligned) address in a dedicated _unaligned field and returns an aligned pointer for use. The bug occurs when dma_free_coherent() is subsequently called with the aligned pointer rather than the unaligned one, leading to incorrect memory deallocation and potential kernel memory corruption or resource leaks. Exploitation requires local access with low privileges (e.g., a standard user account on a system with an ath10k-based WiFi adapter). Patch commits are available across multiple stable kernel branches at kernel.org patches (Feedly).

Successful exploitation can cause denial of service through kernel crashes, system instability, or improper cleanup of DMA buffers, directly impacting wireless network adapter functionality. The vulnerability has no confidentiality or integrity impact — only availability is affected (CVSS A:H). A local attacker with low privileges could trigger kernel memory corruption or resource exhaustion, potentially destabilizing the affected system (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is local, requiring low-privilege access, which limits its attack surface. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The Linux kernel maintainers have released fixes across all affected stable branches. Administrators should upgrade to the following patched versions or later: 5.10.249 (for 5.10.x), 5.15.199 (for 5.15.x), 6.1.162 (for 6.1.x), 6.6.122 (for 6.6.x), 6.12.68 (for 6.12.x), or 6.18.8 (for 6.18.x). Systems using ath10k-based WiFi adapters should be prioritized for patching. Ubuntu has issued multiple security notices (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1) addressing this issue (Ubuntu USN-8180-1, Feedly). Oracle Linux has also issued advisories (ELSA-2026-50160, ELSA-2026-50232). No configuration-based workaround is available; patching is the only remediation.