CVE-2026-23260: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23260 is a memory leak vulnerability in the Linux kernel's regmap maple caching subsystem. It affects Linux kernel versions 6.4 through 6.6 (before 6.6.124), 6.7 through 6.12 (before 6.12.70), 6.13 through 6.18 (before 6.18.10), and 6.19 release candidates up to rc6. The flaw was disclosed on March 18, 2026, and has a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing memory release (CWE-401) in the regcache_maple_write() function within the kernel's regmap maple cache implementation. When this function allocates a new block (entry) to merge adjacent register cache ranges and subsequently calls mas_store_gfp() to store it in the maple tree, a failure of mas_store_gfp() leaves the allocated entry block unreleased. The fix adds a kfree(entry) call on the failure path, while the success path continues to correctly free the replaced neighbor blocks (lower, upper) (Red Hat Bugzilla, Kernel Patch). The vulnerability requires only low privileges and no user interaction to trigger, as it is exploitable via local regmap operations.

A local user with low privileges can repeatedly trigger the memory leak through regmap operations, causing kernel memory to be gradually exhausted and potentially leading to a denial of service condition. There is no impact on confidentiality or integrity — only availability is affected, as the system may become unresponsive or crash due to memory exhaustion (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat Advisory).

Update to a patched Linux kernel version: 6.6.124 or later (for the 6.4–6.6 branch), 6.12.70 or later (for the 6.7–6.12 branch), or 6.18.10 or later (for the 6.13–6.18 branch). For 6.19 release candidates, update to a version after rc6. SUSE has also released security updates addressing this vulnerability (SUSE Advisory, Kernel Patch). No configuration-based workaround is available; patching is the only remediation.

The vulnerability was reported via the standard Linux kernel CVE announcement process by Greg Kroah-Hartman and received routine coverage from security tracking platforms. SUSE issued security update announcements addressing this and related kernel issues. No notable researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking (SUSE Advisory).