CVE-2026-23138: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23138 is an infinite recursion vulnerability in the Linux kernel's kernel stack trace recording functionality within the ftrace/tracing subsystem. When the kernel stack trace trigger is enabled and RCU (Read-Copy-Update) events are traced, the stack trace code calls back into RCU, which in turn re-invokes the stack trace code, creating an unbounded recursive loop. The vulnerability affects Linux kernel versions 5.8 through 6.18.5, as well as release candidates 6.19-rc1 through 6.19-rc4. It was published on February 14, 2026, with patches committed to stable branches on March 17, 2026. The CVSS v3.1 base score is 5.5 (Medium), reflecting a local attack vector requiring low privileges (Feedly).

The root cause is a missing recursion guard in the kernel's stack trace recording code (CWE-674: Uncontrolled Recursion). When ftrace's kernel stack trace trigger fires during RCU event processing, it invokes the stack trace recording function, which itself reads RCU-protected data structures, triggering another RCU event and re-entering the stack trace code. The fix expands ftrace's existing recursion protection by adding per-context bits (normal, softirq, interrupt, NMI) to prevent re-entrant calls; the stack trace code now checks the interrupt context bit before proceeding. Patches were committed to stable kernel branches at git.kernel.org/stable/c/5b7f91acffd2c4c000971553d22efa1e1bb4feae and git.kernel.org/stable/c/5f1ef0dfcb5b7f4a91a9b0e0ba533efd9f7e2cdb (Feedly).

Successful exploitation causes the kernel to enter an infinite recursion loop, exhausting the kernel stack and resulting in a kernel panic, system crash, or complete unresponsiveness — a denial of service condition. An attacker with low-privileged local access who can enable kernel tracing and configure RCU event tracing with the stack trace trigger can reliably crash the system, potentially causing unexpected reboots and service downtime. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Feedly).

The primary remediation is to upgrade the Linux kernel to version 6.18.6 or later, which includes the recursion protection fix. Patches have been committed to stable kernel branches and are available at the kernel.org stable repository. Downstream distributions including Debian (DSA-6238-1), Amazon Linux 2023 (ALAS2023-2026-1594), and openSUSE have issued security advisories incorporating the fix. As a temporary workaround until patching is complete, administrators should disable or restrict kernel stack trace triggers — particularly when tracing RCU events — and limit access to kernel tracing interfaces (e.g., /sys/kernel/debug/tracing/) to trusted administrators only (Feedly, Debian Advisory).

The vulnerability received routine coverage from Linux distribution security teams, with Debian, Amazon Linux, openSUSE, and Yocto Project all issuing advisories. Tenable published multiple Nessus detection plugins (IDs 299078, 309153, 311335, 319993) to identify affected systems. No notable independent researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking (Feedly).