CVE-2026-23198: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23198 is a NULL pointer dereference vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem, specifically in the irqfd (interrupt file descriptor) handling during KVM_IRQFD deassignment. When deassigning a KVM_IRQFD, the kernel incorrectly clobbers the irqfd's copy of the IRQ routing entry type, breaking kvm_arch_irq_bypass_del_producer() on x86 and arm64 architectures and causing potential kernel crashes. Affected kernel versions span from 4.4 through 6.19-rc8, with fixed versions available across multiple stable branches. It was published on February 14, 2026, with patches released on March 19, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference). When a KVM_IRQFD is deassigned, the kernel clobbers the irqfd's routing entry type without notifying architecture-specific code, leaving irqfd->irq_bypass_data pointing to NULL after the irqfd structure memory is reallocated and zeroed. On AMD systems with AVIC (Advanced Virtual Interrupt Controller), this manifests as a NULL pointer dereference in amd_iommu_update_ga() when vCPU load operations attempt to access affinity information; on systems where AVIC is inhibited, it causes list corruption during subsequent irqfd assignments. The fix verifies that the irqfd is still active before consuming routing information, rather than clobbering the entry type. Exploitation requires local access with low privileges (user-mode execution capable of issuing KVM ioctls) (Feedly, Kernel Patch).

Successful exploitation results in a denial of service through kernel crashes or panics, with no confidentiality or integrity impact. On AMD systems, the NULL pointer dereference in amd_iommu_update_ga() causes system crashes during vCPU load operations, while on systems with inhibited AVIC, list corruption can destabilize the kernel during subsequent irqfd assignments. The vulnerability affects the availability of the entire host system running KVM virtualization workloads, potentially impacting all guest VMs hosted on the affected system (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface primarily to users or processes with access to /dev/kvm on affected systems.

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing NULL pointer dereference messages referencing amd_iommu_update_ga(), kvm_arch_irq_bypass_del_producer(), or related KVM irqfd functions.
• Logs: Kernel oops or panic messages associated with KVM vCPU load operations or irqfd assignment/deassignment sequences.
• Process: Unexpected kernel crashes or system reboots on hosts running KVM with VFIO or IRQ bypass functionality enabled, particularly on AMD systems with AVIC support.
• Logs: List corruption warnings in kernel logs during irqfd assignment operations following a prior deassignment.

Apply the available kernel patches immediately. Fixed versions include: 5.10.250, 5.15.200, 6.1.163, 6.6.124, 6.12.70, and 6.18.10 and later in their respective stable branches (Feedly, Kernel Patch). Debian, Ubuntu, and Amazon Linux 2 have issued advisories and updated packages. For systems unable to patch immediately, restrict local access to KVM operations using SELinux or AppArmor policies that limit user-level access to /dev/kvm, and consider disabling KVM or migrating workloads to patched systems. Monitor system logs for kernel crashes, NULL pointer dereference messages, and list corruption warnings.

Debian issued multiple security advisories (DSA-6141-1, DSA-6163-1, DLA-4499-1) addressing this vulnerability alongside other kernel fixes (Linux Security Debian DSA, Linux Security Debian DLA). Ubuntu also released a kernel security update covering this CVE (Linux Security Ubuntu). Amazon Linux 2 published advisories ALAS2KERNEL-5.15-2026-098 and ALAS2KERNEL-5.15-2026-099. Tenable/Nessus and Qualys scanners have added detection for this vulnerability across multiple plugin IDs, indicating broad scanner coverage for enterprise environments.