CVE-2026-23134: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23134 is a denial-of-service vulnerability in the Linux kernel caused by an incomplete context check in the kmalloc_nolock() function on PREEMPT_RT kernels. On PREEMPT_RT systems, local_lock becomes a sleeping lock, but the existing validation only checks for NMI or hard IRQ contexts, missing cases where preemption is disabled. When a BPF program runs from a tracepoint with preemption disabled (preempt_count > 0), the function proceeds to call local_lock_irqsave(), which attempts to acquire a sleeping lock and triggers a kernel BUG. Affected versions include Linux kernel 6.18 (before 6.18.8) and 6.19-rc1 through 6.19-rc6. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is an improper synchronization context check (CWE-667) in kmalloc_nolock() within the Linux kernel slab allocator. On PREEMPT_RT kernels, the function fails to call !preemptible() before invoking local_lock_irqsave(), which on these kernels is a sleeping lock rather than a spinlock. An attacker or process with low privileges can load a BPF program attached to a tracepoint that executes with preemption disabled, causing the kernel to attempt sleeping lock acquisition in an atomic context and triggering the BUG: sleeping function called from invalid context panic. The fix replaces the incomplete NMI/hard-IRQ checks with a !preemptible() check on PREEMPT_RT, which correctly encompasses all invalid contexts (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation results in a denial-of-service condition: the kernel triggers a BUG panic (sleeping function called from invalid context) leading to system instability or crash. The impact is limited to availability — there is no confidentiality or integrity impact. The vulnerability is scoped to systems running PREEMPT_RT-enabled Linux kernels in the affected version range, and does not enable lateral movement or data exfiltration (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the latest available data. The vulnerability requires low privileges (ability to load BPF programs) and local access, limiting its attack surface. The EPSS score is 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

Upgrade Linux kernel installations to version 6.18.8 or later for the 6.18 stable branch; for 6.19-rc users, upgrade to a release version after 6.19-rc6. Patches are available in the Linux kernel stable branch via commits 99a3e3a1cfc9 and f60ba4a97ae3 (added 2026-03-17). As a temporary workaround where immediate patching is not feasible, restrict or disable BPF program execution on PREEMPT_RT systems until the patch is applied (Feedly, Kernel Patch 1, Kernel Patch 2).