CVE-2026-23160: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23160 is a memory leak vulnerability in the Linux kernel's octeon_ep network driver, specifically in the octep_device_setup() function. When octep_ctrl_net_init() fails during device setup, the function returns directly without unmapping previously mapped resources or freeing allocated configuration memory, resulting in a resource leak (CWE-401). The vulnerability affects Linux kernel versions 6.4 through 6.6.122, 6.7 through 6.12.68, and 6.13 through 6.18.8. It was published on February 14, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel patches).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In octep_device_setup(), the error handling path for octep_ctrl_net_init() failure does not jump to the unsupported_dev cleanup label — which performs resource unmapping and memory deallocation — but instead returns immediately, leaving mapped I/O resources and configuration memory unreleased. Exploitation requires local access with low privileges and the ability to trigger repeated device initialization failures. The issue was identified through static analysis tooling and code review, and is compile-tested only (Feedly).

Successful exploitation allows a local, low-privileged attacker to cause memory exhaustion on the affected system by repeatedly triggering the faulty error path in octep_device_setup(). The impact is limited to availability — there is no confidentiality or integrity impact — but sustained memory leakage can lead to system instability, service interruptions, or kernel crashes as available memory is consumed (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting very low probability of exploitation in the near term (Feedly).

Update the Linux kernel to one of the following patched versions: 6.6.123 or later (for the 6.4–6.6 branch), 6.12.69 or later (for the 6.7–6.12 branch), or 6.18.9 or later (for the 6.13–6.18 branch). Patches are available in the Linux kernel stable repositories (kernel patch 1, kernel patch 2, kernel patch 3, kernel patch 4). If immediate patching is not feasible, restrict local unprivileged user access on systems running affected kernel versions and monitor for repeated device initialization failures in kernel logs (Feedly).