CVE-2026-23182: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23182 is a memory leak vulnerability in the Linux kernel's SPI (Serial Peripheral Interface) subsystem, specifically within the Tegra SLINK driver. The flaw exists in the tegra_slink_probe() function, where a failure in platform_get_irq() causes the function to return an error code directly without performing proper cleanup, resulting in a memory leak. The affected component is the Linux kernel (spi: tegra), and the vulnerability was published on February 14, 2026. It carries an estimated CVSS severity of Medium, with an EPSS score of approximately 0.024% (Feedly).

The root cause is classified as a memory leak (CWE-401) — improper resource release when handling an error condition in the tegra_slink_probe() function of the Linux kernel's Tegra SPI SLINK driver. When platform_get_irq() returns a failure, the function exits immediately via a direct return rather than jumping to a cleanup label (goto), leaving previously allocated memory unreleased. The fix involves replacing the direct return with a goto statement that routes execution through the appropriate cleanup path. Patches are referenced in the Linux stable kernel tree (Feedly).

The primary impact of this vulnerability is a kernel memory leak, which can gradually exhaust available memory resources on affected systems over time. This could degrade system stability and availability, particularly on embedded or resource-constrained devices using NVIDIA Tegra SoCs with the SLINK SPI controller. There is no direct confidentiality or integrity impact, and the vulnerability does not enable remote code execution or privilege escalation (Feedly).

CVE-2026-23182 has a very low exploitability profile, with an EPSS score of approximately 0.024%, indicating minimal likelihood of active exploitation. There is no known public proof-of-concept exploit, no evidence of in-the-wild exploitation, no threat actor attribution, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is limited to specific hardware (NVIDIA Tegra platforms with SLINK SPI) and requires local access or specific driver initialization conditions to trigger (Feedly).

The fix has been merged into the Linux stable kernel tree via multiple commits (e.g., 6a04dc650cef, 41d9a6795b95, 126a09f4fcd2, 327b71326cc1, 075415ae18b5) that replace the direct return with a proper goto-based cleanup path in tegra_slink_probe(). Downstream distributions including Debian (DSA-6141-1, DSA-6163-1, DLA-4499-1) and Ubuntu (USN-8393-1) have issued updated kernel packages incorporating this fix (Debian LTS, Feedly). Users should update to the latest patched kernel version provided by their Linux distribution.