CVE-2026-23145: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23145 is a memory leak vulnerability in the Linux kernel's ext4 filesystem implementation, specifically in the ext4_xattr_inode_update_ref function. The error handling branch in this function fails to release the reference count (refcount) for iloc.bh (inode location buffer), resulting in kernel memory not being freed after its effective lifetime (CWE-401). It affects multiple Linux kernel stable branches and was published on February 14, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), exploitable locally by a low-privileged user (Feedly).

The root cause is a missing buffer head release (brelse(iloc.bh)) in the error exit path of ext4_xattr_inode_update_ref in the Linux kernel's ext4 filesystem driver, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). When the function encounters an error condition, it returns without decrementing the reference count on the iloc.bh buffer, causing a kernel memory leak. Exploitation requires local access with low privileges to trigger the vulnerable code path — for example, by performing ext4 extended attribute operations that induce the error branch. The vulnerability was identified through code review rather than active exploitation (Feedly, Kernel Patch).

Successful exploitation allows a local low-privileged attacker to cause a denial of service through gradual kernel memory exhaustion. By repeatedly triggering the error condition in ext4_xattr_inode_update_ref, an attacker can leak kernel buffer memory, degrading system performance and potentially rendering the kernel unavailable. There is no impact on confidentiality or data integrity — only system availability is affected (Feedly).

Patches have been applied across multiple Linux kernel stable branches. Users should update to versions beyond the following affected ranges: 5.4.301–5.5 (fix: 5.5+), 5.10.246–5.10.249 (fix: 5.10.249+), 5.15.195–5.15.199 (fix: 5.15.199+), 6.1.157–6.1.162 (fix: 6.1.162+), 6.6.113–6.6.122 (fix: 6.6.122+), 6.12.54–6.12.67 (fix: 6.12.67+), and 6.17.4–6.18.7 (fix: 6.18.7+). Upstream kernel commits are available in the Linux stable repositories. If immediate patching is not feasible, restrict local system access to trusted users only, as exploitation requires local low-privilege access. Ubuntu security notices USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1, and Amazon Linux ALAS2KERNEL-5.15-2026-098/099 also address this issue (Feedly, Ubuntu USN-8180-1, AWS ALAS).