CVE-2026-23186: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23186 is an improper locking vulnerability in the Linux kernel's acpi_power_meter hardware monitoring driver that can cause system deadlocks. The flaw resides in the acpi_power_meter_notify() callback function, which calls hwmon_device_unregister() while holding a lock also acquired by sysfs attribute callbacks, creating deadlock conditions between sysfs access and device removal. Affected versions include Linux kernel 6.15 through 6.18.9 and 6.19-rc1 through 6.19-rc8. It was published on February 14, 2026, with patches added on March 18, 2026. The CVSS v3.1 base score is 5.5 (Medium), reflecting a local attack vector with high availability impact (Feedly).

The root cause is classified as CWE-667 (Improper Locking). The acpi_power_meter_notify() function holds an internal lock while calling hwmon_device_unregister(), but sysfs attribute callbacks for the device being unregistered also attempt to acquire the same lock, creating a classic deadlock scenario. Additionally, two concurrent METER_NOTIFY_CONFIG notifications could simultaneously attempt to remove the same hwmon device, compounding the race condition. The fix introduces a new static serialization mutex around the switch() statement in acpi_power_meter_notify() and moves hwmon_device_unregister() and hwmon_device_register_with_info() calls outside the inner lock (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful triggering of this vulnerability causes system deadlocks, rendering the affected system unresponsive or hung — a direct availability impact with no confidentiality or integrity consequences. The deadlock can be triggered when sysfs power meter attributes are accessed concurrently with ACPI device removal events, or when two concurrent METER_NOTIFY_CONFIG notifications race to remove the same device. Systems running Linux kernel versions 6.15 through 6.18.9 and 6.19-rc1 through 6.19-rc8 with ACPI power meter hardware are at risk of system instability or complete hang (Feedly).

The primary remediation is to update the Linux kernel to version 6.18.10 or later, which includes the fix commits 615901b57b7ef8eb655f71358f7e956e42bcd16b and 8860ddf0e07be37169d4ef9f2618e39fca934a66. Systems running 6.19 release candidate versions should wait for or upgrade to the stable 6.19 release. As a temporary workaround, restricting local user access to sysfs power meter attributes can reduce exposure, though this does not fully eliminate the risk from ACPI notification races (Feedly, Kernel Patch 1, Kernel Patch 2).