CVE-2026-23305: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23305 is a Linux kernel vulnerability in the accel/rocket accelerator driver caused by improper error path unwinding in the rocket_probe function. When rocket_core_init() fails (e.g., due to EPROBE_DEFER), the driver fails to decrement a reference counter and omits cleanup via rocket_device_fini(), resulting in out-of-bounds memory accesses. The vulnerability affects Linux kernel versions 6.18.0 through 6.18.16 and 6.19.0 through 6.19.6. It was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing resource release (CWE-772) combined with an out-of-bounds read (CWE-125) in the rocket_probe function of the accel/rocket DRM driver. When rocket_core_init() returns an error, the code path fails to decrement the core counter it just incremented and — if this is the first core being probed — also fails to call rocket_device_fini() to tear down the DRM device. This inconsistency with the cleanup logic in rocket_remove() leaves internal state corrupted, enabling subsequent out-of-bounds memory accesses. Exploitation requires local access and low privileges, as an attacker must be able to trigger probe deferral events in the rocket driver (Red Hat Bugzilla, Feedly).

A local attacker with standard user privileges can trigger out-of-bounds kernel memory reads, potentially disclosing sensitive kernel memory contents, or cause a kernel crash resulting in a denial of service. The confidentiality and availability impacts are rated High, while integrity is not directly affected. The vulnerability is scoped to the local system and does not inherently enable lateral movement, but kernel memory disclosure could facilitate privilege escalation or information gathering for further attacks (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and the presence of the accel/rocket driver on the target system (Feedly).

Update the Linux kernel to version 6.18.17 or later (for the 6.18.x branch) or 6.19.7 or later (for the 6.19.x branch), where the fix has been committed to stable branches. Patches are available at the upstream kernel stable repository. If immediate patching is not feasible, consider disabling or restricting access to the accel/rocket accelerator driver if it is not required for system functionality. No configuration-based workaround has been officially documented beyond driver disablement (Red Hat Bugzilla, Kernel Patch 6.18, Kernel Patch 6.19).