CVE-2026-23140: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23140 is a denial-of-service vulnerability in the Linux kernel's BPF test run subsystem (bpf_test_run) caused by improper handling of XDP frame metadata size validation. The flaw allows a local low-privileged user to supply an oversized metadata value that consumes the entire XDP frame headroom, leading to packet transmission proceeding with an uninitialized xdp_frame structure. It was published on February 14, 2026, and affects Linux kernel versions from 5.18 up to (but not including) 6.1.161, 6.2–6.6.121, 6.7–6.12.66, and 6.13–6.18.6, as well as 6.19 release candidates rc1 through rc5. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is an incomplete bounds check (CWE-20: Improper Input Validation) in the bpf_test_run function: the size of the xdp_frame structure is not subtracted from the permitted metadata size before validation, allowing userspace to specify a metadata region that occupies the full XDP headroom. In live packet mode, this causes xdp_update_frame_from_buff() called within xdp_test_run_init_page() to fail, after which packet transmission continues using an uninitialized xdp_frame structure — a classic use-of-uninitialized-memory scenario. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction. Patches reorder the metadata size checks and add an explicit constraint subtracting sizeof(struct xdp_frame) from the allowed headroom (Feedly, Kernel Patch).

Successful exploitation results in a denial of service through kernel memory corruption and system instability caused by uninitialized frame structure handling during XDP packet transmission. There is no confidentiality or integrity impact — the vulnerability is limited to availability (A:H). Lateral movement or data exfiltration are not directly enabled by this flaw, but kernel instability could be leveraged as part of a broader local privilege escalation chain in combination with other vulnerabilities (Feedly).

Apply the upstream kernel patches available for the following stable branches: upgrade to kernel 6.1.161 or later, 6.6.121 or later, 6.12.66 or later, or 6.18.6 or later, depending on the deployed version. Distributions including Oracle Linux, SUSE, openSUSE, and Ubuntu have issued advisories and updated packages incorporating these fixes. As a temporary workaround where patching is not immediately possible, restrict local system access to trusted users and limit unprivileged BPF usage via kernel.unprivileged_bpf_disabled=1 sysctl setting (Feedly, SUSE Advisory).

Multiple Linux distribution vendors — including SUSE, Oracle Linux, openSUSE, and Ubuntu — have issued security advisories and kernel update packages addressing this vulnerability. Tenable has published several Nessus detection plugins (IDs 299170, 301875, 309153, 318847) covering affected distributions. The Yocto Project security mailing list also flagged the issue for embedded Linux maintainers. No notable independent researcher commentary or significant social media discussion has been identified (Feedly, SUSE Advisory).