CVE-2026-23164: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23164 is a memory leak vulnerability in the Linux kernel's rocker network driver, specifically in the rocker_world_port_post_fini() function. The flaw causes kernel memory allocated during port initialization (rocker_port->wpriv) to never be freed when ports are removed, because the kfree() call is incorrectly gated behind a check for the port_post_fini callback — which is NULL for rocker_ofdpa_ops. The vulnerability affects Linux kernel versions from 4.6 up to (but not including) 5.10.249, 5.11–5.15.199, 5.16–6.1.162, 6.2–6.6.123, 6.7–6.12.69, 6.13–6.18.9, and pre-release 6.19-rc1 through rc7. It was published on February 14, 2026, with patches released March 18, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel patches).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In rocker_world_port_pre_init(), rocker_port->wpriv is allocated via kzalloc(wops->port_priv_size, GFP_KERNEL). However, in rocker_world_port_post_fini(), the corresponding kfree(rocker_port->wpriv) is only reached if wops->port_post_fini is non-NULL — but rocker_ofdpa_ops does not implement this callback, so it is NULL. As a result, sizeof(struct ofdpa_port) bytes of kernel memory are leaked per port on every device removal. The fix restructures the cleanup logic to unconditionally call kfree(rocker_port->wpriv) regardless of whether the port_post_fini callback is set (Feedly, kernel patches).

The primary impact is an availability degradation: repeated device removal and re-addition cycles cause cumulative kernel memory exhaustion, which can eventually lead to system instability or denial of service on affected hosts. There is no confidentiality or integrity impact, as the vulnerability does not expose sensitive data or allow unauthorized modification of system state. The scope is limited to the local system running a vulnerable kernel with the rocker driver in use (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-23164. The vulnerability requires local access with low privileges (e.g., the ability to trigger network device removal), making remote exploitation infeasible. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The Linux kernel maintainers have released patches across all affected stable branches. Users should upgrade to the following fixed versions or later: 5.10.249, 5.15.199, 6.1.162, 6.6.123, 6.12.69, or 6.18.9. Multiple distribution vendors — including Ubuntu (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1, USN-8393-1), Oracle Linux, and Amazon Linux 2 — have issued updated kernel packages. As a workaround where patching is not immediately possible, avoiding repeated hot-plug removal of rocker-based network devices can reduce the rate of memory accumulation (Ubuntu Advisory, kernel patches, Amazon Linux).