CVE-2026-23284: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-23284 is a use-after-free vulnerability in the Linux kernel's Mediatek Ethernet driver (mtk_eth_soc) caused by improper handling of eBPF program pointers during XDP setup failure. Specifically, when the mtk_open routine fails inside mtk_xdp_setup(), the eBPF program pointer is not reset to the previous (old_prog) value, and the old program's reference count is incorrectly decremented, potentially leading to a use-after-free condition. The vulnerability was published on March 25, 2026, and affects Linux kernel versions from 6.0 through multiple stable branches up to (but not including) their respective patched releases. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-911 (Improper Update of Reference Count). In mtk_xdp_setup(), when an XDP program is being attached or replaced on a Mediatek Ethernet interface, the function calls mtk_open to bring up the interface. If mtk_open fails, the code path does not restore the prog pointer to old_prog and incorrectly calls bpf_prog_put() on the old program, decrementing its reference count prematurely. This can result in the kernel freeing the eBPF program object while it is still referenced elsewhere, creating a use-after-free condition exploitable by a local user with privileges to load eBPF programs and configure network devices (Red Hat CVE, Feedly). The attack vector is local, requires low privileges, and no user interaction (Feedly).

Successful exploitation can result in reading sensitive kernel memory, corrupting kernel data structures, or executing arbitrary code within the kernel context, effectively enabling local privilege escalation. The availability impact is rated High, as kernel memory corruption can also lead to system crashes or denial of service. Confidentiality and integrity impacts are limited by the local attack vector and the requirement for elevated eBPF/network configuration capabilities (Feedly, Red Hat CVE).

Patches have been released for all affected stable kernel branches. The fixed versions are: 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc3 (Feedly). Upstream kernel commits are available via the stable kernel git repository. As a workaround, restricting access to eBPF program loading (e.g., via kernel.unprivileged_bpf_disabled=1 sysctl) and limiting network device configuration to trusted users reduces the attack surface. Users should apply vendor-specific updates from Red Hat, Debian, Microsoft (Azure Linux), or their respective distribution (Red Hat CVE, Microsoft MSRC).

The vulnerability has been tracked by Red Hat, Microsoft (for Azure Linux), Debian, and the Yocto Project, all of which have issued or referenced relevant security advisories. Debian issued DSA-6238-1 and DSA-6243-1 addressing this and related kernel issues, and a Debian LTS advisory (DLA-4561-1) was also published for linux-6.1 (Linux Security Debian DSA-6238, Linux Security Debian DSA-6243). No notable independent researcher commentary or significant social media discussion has been observed for this vulnerability.