CVE-2026-23176: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23176 is a memory leak vulnerability in the Linux kernel's platform/x86: toshiba_haps driver. The flaw exists in the toshiba_haps_add() and toshiba_haps_remove() routines: the add function leaks the haps object if it returns an error after successful allocation, and the remove function fails to free the object before clearing the pointer, rendering the memory unreachable. The vulnerability was published on February 14, 2026, and affects the Linux kernel. It carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.024% (Feedly).

The root cause is improper memory management (CWE-401: Missing Release of Memory after Effective Lifetime) in the toshiba_haps platform driver within the Linux kernel. In toshiba_haps_add(), if an error occurs after the haps object is allocated via kzalloc(), the function returns without freeing the allocation, causing a memory leak. In toshiba_haps_remove(), the pointer to the allocated object is cleared without first calling kfree(), making the memory permanently unreachable. The fix replaces kzalloc() with devm_kzalloc(), which ties the allocation lifetime to the device and ensures automatic cleanup on device removal or error (Feedly).

The primary impact of this vulnerability is a kernel memory leak, which can gradually exhaust available kernel memory on affected systems over time, potentially leading to degraded system performance or denial of service conditions. The vulnerability is limited in scope to systems running the toshiba_haps driver (Toshiba HDD Active Protection System hardware), and exploitation does not directly enable privilege escalation, code execution, or data exfiltration. The availability impact is the main concern, as repeated triggering of the affected code paths could contribute to resource exhaustion (Feedly).

The fix has been applied to the Linux kernel mainline and stable trees via commits that replace kzalloc() with devm_kzalloc() in the toshiba_haps driver. Downstream distributions including Debian (DSA-6141-1, DLA-4499-1, DSA-6163-1) and Ubuntu (USN-8393-1) have issued kernel security updates addressing this and related vulnerabilities. Users should update to the latest patched kernel version provided by their Linux distribution. Systems not using Toshiba HDD Active Protection System hardware are not affected by this specific driver issue (Feedly, Debian LTS).