CVE-2026-23287: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23287 is a race condition vulnerability in the Linux kernel's SiFive PLIC (Platform-Level Interrupt Controller) driver that can cause device interrupts to become permanently frozen. The flaw arises when interrupt affinity is changed while a hart (hardware thread) is still handling that interrupt, causing the PLIC to silently ignore the interrupt completion message and leaving the interrupt in an unrecoverable state. Affected Linux kernel versions include 5.1 through 6.1.166, 6.2 through 6.6.129, 6.7 through 6.12.76, 6.13 through 6.18.16, and 6.19 through 6.19.6. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) in the plic_irq_eoi() function of the SiFive PLIC driver. The existing fix checked irqd_irq_disabled() to determine whether to re-enable an interrupt before sending the completion message; however, this check is insufficient because the PLIC's hardware enable bit for the handling hart can be cleared to zero when affinity is changed mid-handler, even while irqd_irq_disabled() returns false. The PLIC specification states that completion messages for disabled interrupt sources are silently ignored, so the completion is dropped and the interrupt becomes frozen. The fix replaces the software-level irqd_irq_disabled() check with a direct inspection of the PLIC's hardware enable bit (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation causes a denial of service by permanently freezing the affected device's interrupt handling — for example, a UART port becomes completely unresponsive. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS A:H). The affected scope is limited to systems using SiFive PLIC hardware (RISC-V platforms), and the frozen interrupt state is unrecoverable without a reboot or driver reload (Red Hat Advisory, Red Hat Bugzilla).

Exploitation requires local access with low privileges — specifically, permission to modify interrupt affinity settings (e.g., write access to /proc/irq/<N>/smp_affinity). The attack is easily reproducible by generating high-frequency interrupts (e.g., dumping a large file to UART) while simultaneously and repeatedly changing the interrupt's CPU affinity. No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation. The EPSS score is 0.024% (very low), and the vulnerability is not listed in the CISA KEV catalog (Red Hat Advisory).

1. Gain local access: Obtain a local user account on a RISC-V system using SiFive PLIC hardware running a vulnerable Linux kernel version.
2. Verify affinity write permissions: Confirm write access to /proc/irq/<N>/smp_affinity or /proc/irq/<N>/smp_affinity_list for the target interrupt (e.g., a UART interrupt).
3. Generate high-frequency interrupts: Initiate a high-interrupt-rate operation such as dd if=/dev/urandom of=/dev/ttyS0 bs=1M to continuously trigger the target interrupt handler.
4. Rapidly change interrupt affinity: In a parallel loop, repeatedly write different CPU affinity masks to /proc/irq/<N>/smp_affinity (e.g., alternating between CPU 0 and CPU 1) to race the affinity change against the active interrupt handler.
5. Trigger frozen state: The race condition causes the PLIC enable bit to be cleared for the handling hart while the completion message is sent, which is silently ignored by the PLIC hardware, leaving the interrupt permanently frozen and the device unresponsive (Red Hat Bugzilla).

• Logs: Kernel messages indicating a device (e.g., UART/serial port) has stopped responding; absence of expected interrupt activity in /proc/interrupts for the affected IRQ line after the race condition is triggered.
• System Behavior: A device (e.g., /dev/ttyS0) becomes completely unresponsive and cannot be recovered without a reboot or driver reload; the interrupt count for the affected IRQ stops incrementing in /proc/interrupts.
• Process Activity: Unusual or scripted repeated writes to /proc/irq/<N>/smp_affinity or /proc/irq/<N>/smp_affinity_list by a non-root or low-privilege user, potentially visible in process audit logs.

Update the Linux kernel to one of the patched stable versions: 6.1.167 or later, 6.6.130 or later, 6.12.77 or later, 6.18.17 or later, or 6.19.7 or later. Debian has issued security advisories (DSA-6238-1, DSA-6243-1, DLA-4561-1) addressing this vulnerability. As a workaround, restrict unprivileged user access to /proc/irq/*/smp_affinity to prevent unauthorized modification of interrupt affinity settings, and avoid changing interrupt affinity during high-frequency interrupt-generating operations (Red Hat Advisory, Debian DSA-6238, Debian DSA-6243).