CVE-2026-23137: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23137 is a memory leak vulnerability in the Linux kernel's device tree unit testing code (of/unittest.c). Specifically, in the unittest_data_add() function, if of_resolve_phandles() fails, the allocated unittest_data buffer is not freed, resulting in a missing release of memory after its effective lifetime (CWE-401). The vulnerability affects Linux kernel versions 3.18 through 6.18.5, as well as 6.19-rc1 through 6.19-rc4. It was published on February 14, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper resource management (CWE-401) in unittest_data_add() within the kernel's Open Firmware (OF) unit test subsystem. When of_resolve_phandles() returns an error, the function exits without freeing the previously allocated unittest_data buffer, leaking kernel memory. The fix applies scope-based cleanup using the __free(kfree) helper for automatic deallocation on error paths, and uses retain_and_null_ptr() on the success path to transfer ownership to the device tree and prevent double-free. Exploitation requires local access with low privileges and no user interaction (Feedly, Kernel Patch 1, Kernel Patch 2).

A local attacker with low privileges can repeatedly trigger the memory leak in unittest_data_add(), progressively exhausting available kernel memory. This leads to denial of service — degrading system stability and performance, and potentially causing the system to become unresponsive or crash. There is no impact on confidentiality or integrity; the vulnerability is limited to availability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Nessus (plugin 299076) and Qualys (detection 761861) (Feedly).

The vulnerability is patched in Linux kernel version 6.18.6 and later. Upstream patch commits are available at the kernel stable trees: 235a1eb and f09b0f7. Administrators should upgrade affected systems (kernel versions 3.18–6.18.5 and 6.19-rc1 through rc4) to 6.18.6 or a later stable release. As a secondary measure, limiting local access to privileged accounts reduces the attack surface (Feedly).