CVE-2026-23218: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23218 is a NULL pointer dereference vulnerability in the Linux kernel's Loongson 64-bit GPIO driver (gpio/loongson-64bit). The flaw exists in the loongson_gpio_init_irqchip() function, which incorrectly checks chip->parent instead of chip->irq.parents after a devm_kcalloc() call, potentially allowing a NULL pointer dereference if memory allocation fails. It was published on February 18, 2026, and affects Linux kernel versions 6.18.0 through 6.18.9 (before 6.18.10) as well as 6.19 release candidates (rc1–rc8). The CVSS v3.1 base score is 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In loongson_gpio_init_irqchip(), after calling devm_kcalloc() to allocate memory for chip->irq.parents, the code erroneously validates chip->parent (a different field) rather than the newly allocated chip->irq.parents pointer. If devm_kcalloc() returns NULL due to memory allocation failure, the incorrect NULL check fails to catch this condition, and subsequent use of the uninitialized chip->irq.parents pointer causes a kernel NULL pointer dereference. Exploitation requires local access with low privileges and no user interaction. Patches are available via the upstream kernel stable tree (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).

Successful exploitation can cause a kernel crash, resulting in a denial of service (DoS) condition on affected systems. The vulnerability has no impact on confidentiality or integrity — only availability is affected. The scope is limited to systems running Loongson 64-bit hardware with the affected GPIO driver active, and the impact is confined to the local system without potential for lateral movement (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation is limited to local attackers with low-privilege access on Loongson 64-bit systems, further constraining the attack surface (Red Hat Advisory).

Update the Linux kernel to version 6.18.10 or later, which includes the corrected NULL check in loongson_gpio_init_irqchip(). Two upstream patches have been committed to the stable kernel tree addressing this issue. Systems not using Loongson 64-bit GPIO hardware are not affected. No configuration-based workaround is documented; upgrading to a patched kernel version is the recommended remediation (Kernel Patch 1, Kernel Patch 2, Red Hat Bugzilla).