CVE-2026-23158: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23158 is a use-after-free (UAF) vulnerability in the Linux kernel's gpio-virtuser configfs release path. The flaw causes mutex_unlock() to operate on already-freed memory when gpio_virtuser_device_config_group_release() destroys the mutex and frees the device structure while still inside a guard(mutex) scope. Affected versions include Linux kernel 6.11.x through 6.12.x (before 6.12.69), 6.13.x through 6.18.x (before 6.18.9), and 6.19 release candidates (rc1–rc7). It was published on February 14, 2026, with patches added on March 18, 2026. The CVSS v3.1 base score is 7.8 (High) (Feedly).

The root cause is a use-after-free condition (CWE-416) in the gpio_virtuser_device_config_group_release() function within the Linux kernel's gpio-virtuser configfs subsystem. The function uses guard(mutex) to protect the device structure, but calls mutex_destroy() and kfree() on the device while still within the guard's scope; when the function returns, the guard cleanup invokes mutex_unlock(&dev->lock) on the now-freed memory, resulting in a slab use-after-free. The fix limits the mutex lifetime by replacing guard(mutex) with scoped_guard() applied only around the activation check, ensuring the lock is released before mutex_destroy() and kfree() are called. Exploitation requires local access with low privileges and involves crafting specific configfs operations to trigger the vulnerable release path (Feedly, Kernel Patch 1).

Successful exploitation of this vulnerability by a local attacker with low privileges could result in kernel memory corruption, system crashes (denial of service), or arbitrary code execution in kernel context. The confidentiality, integrity, and availability impacts are all rated High, meaning an attacker could potentially escalate privileges, corrupt kernel data structures, or cause a kernel panic. The scope is limited to the local system, but privilege escalation could enable further lateral movement within a compromised environment (Feedly).

1. Gain local access: Obtain a low-privilege local user account on a system running a vulnerable Linux kernel version (6.11.x–6.12.x before 6.12.69, or 6.13.x–6.18.x before 6.18.9).
2. Verify gpio-virtuser configfs availability: Confirm that the gpio-virtuser kernel module is loaded and that configfs is mounted (e.g., lsmod | grep gpio_virtuser and mount | grep configfs).
3. Create a gpio-virtuser configfs device: Use configfs interfaces (typically under /sys/kernel/config/) to create a gpio-virtuser device group, triggering allocation of the associated device structure and mutex.
4. Trigger the release path: Remove or release the configfs device group in a manner that causes gpio_virtuser_device_config_group_release() to execute, which destroys the mutex and frees the device while still inside the guard(mutex) scope.
5. Exploit the use-after-free: The guard cleanup invokes mutex_unlock(&dev->lock) on the freed memory slab. An attacker may time heap manipulation to control the freed memory region, potentially redirecting kernel execution flow or corrupting kernel data structures to achieve privilege escalation (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing slab use-after-free errors, KASAN (Kernel Address Sanitizer) reports referencing gpio_virtuser_device_config_group_release, or general protection fault (GPF) messages related to mutex operations.
• Process: Unexpected kernel panics or oops messages involving mutex_unlock on freed memory; unusual processes interacting with configfs gpio-virtuser paths.
• File System: Unusual or repeated creation/deletion of entries under /sys/kernel/config/ related to gpio-virtuser devices by non-root low-privilege users.

Apply the available kernel security updates immediately. For the 6.11–6.12 series, upgrade to Linux kernel 6.12.69 or later; for the 6.13–6.18 series, upgrade to 6.18.9 or later. Three upstream patches have been published at git.kernel.org addressing this issue. No configuration-based workaround is documented; if upgrading is not immediately possible, consider restricting access to configfs and unloading the gpio-virtuser kernel module if it is not required (Feedly, Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).

The vulnerability was noted by VulDB and discussed briefly in security aggregator feeds shortly after publication in February 2026. The Yocto Project security mailing list referenced the CVE in the context of embedded Linux security updates. No significant vendor statements, notable researcher commentary, or broad media coverage has been identified beyond standard vulnerability database entries (Feedly).