CVE-2026-23162: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23162 is a double-free vulnerability in the Linux kernel's DRM (Direct Rendering Manager) xe/nvm subsystem, specifically in the auxiliary device initialization failure path of the xe_nvm_init() function. When auxiliary_device_add() fails, the driver calls auxiliary_device_uninit(), which triggers the .release callback (xe_nvm_release_dev()) to free the associated memory — but the error handling path then attempts to free the same memory a second time, causing heap corruption. The vulnerability was published on February 14, 2026, and affects Linux kernel versions 6.17.1 through 6.18.8, as well as 6.17, 6.17-rc7, and 6.19-rc1 through 6.19-rc7. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly, CVE.org).

The root cause is classified as CWE-415 (Double Free): after a successful auxiliary_device_init(), the aux_dev->dev.release pointer is set to xe_nvm_release_dev(), which is responsible for calling kfree(nvm). If auxiliary_device_add() subsequently fails, the driver correctly calls auxiliary_device_uninit() → put_device(), which triggers the .release callback and frees the memory. However, the original error-handling goto path also called kfree(nvm) directly, resulting in a double-free. The fix moves kfree(nvm) exclusively into the auxiliary_device_init() failure path and removes the redundant err goto path. KASAN (Kernel Address Sanitizer) reports the bug as BUG: KASAN: double-free in xe_nvm_init+0x751/0xf10 [xe], triggered during device initialization by systemd-udevd. Exploitation requires local access with low privileges (Feedly).

Successful exploitation of this double-free vulnerability can result in heap memory corruption, potentially leading to denial of service (system crash or hang), information disclosure from corrupted kernel memory, or arbitrary code execution with the privileges of the affected kernel process. Because the vulnerability is triggered during xe graphics driver initialization, it can be exploited by a local low-privileged user on systems with the affected xe GPU driver loaded, making it particularly relevant in multi-user environments. There is no evidence of lateral movement capability beyond the local system (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) containing BUG: KASAN: double-free in xe_nvm_init or references to xe_nvm_init+0x751/0xf10 [xe].
• Logs: Kernel panic or oops messages referencing xe_nvm_release_dev or auxiliary_device_uninit during system boot or GPU driver initialization.
• Process: Unexpected crashes or hangs of systemd-udevd (PID associated with device initialization) during xe driver load.
• File System: Presence of kernel crash dumps (/var/crash/, /proc/vmcore) generated during xe driver initialization on affected kernel versions.

Update the Linux kernel to version 6.18.9 or later, which includes the fix for this vulnerability. The patches are available at two commits in the stable kernel tree: 32887d8e4bc0696b3cb6c5915a42b39cfd3434f4 and 8a44241b0b83a6047c5448da1fff03fcc29496b5 on git.kernel.org. As a temporary workaround on systems that cannot be immediately updated, administrators may consider blacklisting the xe kernel module (modprobe.blacklist=xe) if the Intel Xe GPU driver is not required, though this will disable associated GPU functionality. Systems running kernel versions 6.17.1 through 6.18.8, 6.17, 6.17-rc7, or 6.19-rc1 through 6.19-rc7 with the xe driver loaded should prioritize patching (Feedly, Kernel Patch 1, Kernel Patch 2).