CVE-2026-23137: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23137 is a memory leak vulnerability in the Linux kernel's device tree unit testing code (of/unittest.c). Specifically, in the unittest_data_add() function, if of_resolve_phandles() fails, the allocated unittest_data buffer is not freed, resulting in a missing release of memory after its effective lifetime (CWE-401). The vulnerability affects Linux kernel versions 3.18 through 6.18.5, as well as 6.19-rc1 through 6.19-rc4. It was published on February 14, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper resource management (CWE-401) in unittest_data_add() within the kernel's Open Firmware (OF) unit test subsystem. When of_resolve_phandles() returns an error, the function exits without freeing the previously allocated unittest_data buffer, leaking kernel memory. The fix applies scope-based cleanup using the __free(kfree) helper for automatic deallocation on error paths, and uses retain_and_null_ptr() on the success path to transfer ownership to the device tree and prevent double-free. Exploitation requires local access with low privileges and no user interaction (Feedly, Kernel Patch 1, Kernel Patch 2).

A local attacker with low privileges can repeatedly trigger the memory leak in unittest_data_add(), progressively exhausting available kernel memory. This leads to denial of service — degrading system stability and performance, and potentially causing the system to become unresponsive or crash. There is no impact on confidentiality or integrity; the vulnerability is limited to availability (Feedly).

The vulnerability is patched in Linux kernel version 6.18.6 and later. Upstream patch commits are available at the kernel stable trees: 235a1eb and f09b0f7. Administrators should upgrade affected systems (kernel versions 3.18–6.18.5 and 6.19-rc1 through rc4) to 6.18.6 or a later stable release. As a secondary measure, limiting local access to privileged accounts reduces the attack surface (Feedly).