CVE-2026-23313: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23313 is a preempt count leak vulnerability in the Linux kernel's i40e (Intel 40 Gigabit Ethernet) driver, specifically within the NAPI poll tracepoint. The flaw arises from the use of get_cpu() without a corresponding put_cpu() call, causing the kernel's preemption counter to become unbalanced. It affects Linux kernel versions 6.2 through 6.6.136, 6.7 through 6.12.77, 6.13 through 6.18.17, 6.19 through 6.19.7, and release candidates 7.0-rc1 and 7.0-rc2. Disclosed on March 25, 2026, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-911 (Improper Update of Reference Count). In the i40e driver's NAPI poll tracepoint, get_cpu() was used to obtain the current CPU ID, which also disables preemption and increments the preemption counter. However, the corresponding put_cpu() — which would re-enable preemption and decrement the counter — was never called, resulting in a persistent counter imbalance. The kernel reports this as: softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100, exited with 00000101?. The fix replaces get_cpu() with smp_processor_id(), which retrieves the CPU ID without modifying the preemption counter (Red Hat Bugzilla, Kernel Patch).

Successful exploitation allows a local, low-privileged user to cause a denial of service by triggering network receive (NAPI) polling operations on systems using i40e network interfaces. The repeated preempt count imbalance corrupts kernel scheduling state, potentially leading to system crashes, hangs, or unpredictable behavior. There is no impact on confidentiality or integrity; the vulnerability is limited to availability (Red Hat Advisory).

Apply the upstream kernel patches that replace get_cpu() with smp_processor_id() in the i40e NAPI poll tracepoint. Fixed versions include Linux kernel 6.6.136, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc3 or later. Distribution-specific updates are available from Red Hat, SUSE (SUSE-SU-202621834-1, SUSE-SU-20262217-1, SUSE-SU-20262238-1), Debian (DSA-6238-1), and Amazon Linux 2023 (ALAS2023-2026-1543, ALAS2023-2026-1596) (Red Hat Advisory, Kernel Patch).