CVE-2026-23147: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23147 is a memory leak vulnerability in the Linux kernel's btrfs zlib compression subsystem, specifically affecting the S390 hardware acceleration path. The flaw was introduced by commit aa60fe12b4f4 ("btrfs: zlib: refactor S390x HW acceleration buffer preparation"), which omitted the required folio_put() call after processing page cache folios returned by btrfs_compress_filemap_get_folio(). It affects Linux kernel versions 6.15 through 6.18.8 and release candidates of 6.19 (rc1–rc7). The vulnerability was published on February 14, 2026, with patches made available on March 17, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, CVE Record).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). During S390 hardware-accelerated btrfs zlib compression, the refactored copy_data_into_buffer() function fails to call folio_put() after processing each page cache folio, causing those folios to never be released back to the memory subsystem. Prior to the refactoring commit, kunmap_local() and folio_put() were called within the loop (albeit with imperfect timing), ensuring eventual release. The attack vector is local, requiring low privileges and no user interaction, and is only triggered on systems using S390 hardware acceleration for btrfs compression (Feedly, Kernel Patch 1).

Exploitation of this vulnerability leads to progressive memory exhaustion on affected systems, as unreleased page cache folios accumulate over time during btrfs compression operations using S390 hardware acceleration. This degrades system performance and can ultimately cause a denial-of-service condition when available memory is fully consumed. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Feedly).

Update the Linux kernel to version 6.18.9 or later, which includes the fix adding the missing folio_put() call in copy_data_into_buffer(). Patches are available in the kernel stable branches at the following commits: 0d0f1314e8f8 and e80617a5e1c2. Systems not using S390 hardware acceleration for btrfs compression are not affected. If immediate patching is not feasible, consider disabling S390 hardware acceleration for btrfs or restricting local access to compression-intensive workloads (Feedly, Kernel Patch 1).