CVE-2026-23314: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23314 is a resource leak vulnerability in the Linux kernel's bq257xx regulator driver. Specifically, in the bq257xx_reg_dt_parse_gpio() function, when a failure occurs while retrieving a subchild device node, the function returns without calling of_node_put(child), causing a device node reference leak. The vulnerability affects Linux kernel versions 6.18, 6.18.1–6.18.16, 6.19.0–6.19.6, and 7.0-rc1 through rc7. It was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime). In bq257xx_reg_dt_parse_gpio(), the function iterates over device tree child nodes and acquires a reference to a child node via a kernel OF API call. If a subsequent call to retrieve a subchild fails, the function returns an error without invoking of_node_put(child) to decrement the reference count, resulting in a kernel memory reference leak. Exploitation requires local access with low privileges, as an attacker would need to repeatedly trigger the parsing failure path to accumulate leaked references and exhaust kernel memory (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation can lead to denial of service on affected systems, particularly embedded and IoT devices utilizing the bq257xx regulator driver. A local attacker with low privileges could repeatedly trigger the GPIO configuration parsing failure to exhaust kernel memory, potentially causing system instability or a crash. There is no impact on confidentiality or integrity; the vulnerability is limited to availability (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is constrained to local, low-privilege attackers on systems running the affected kernel versions with the bq257xx driver loaded (Red Hat Advisory).

Patches are available in Linux kernel versions 6.18.17 (for 6.18.1–6.18.16), 6.19.7 (for 6.19.0–6.19.6), and 7.0-rc2 and later. The fixes are available via upstream kernel commits 4baaddaa44af01cd4ce239493060738fd0881835, 93b64bef8cd4074806d981ed1b4c38c3ae0542e3, and aba54a5a113667df9d339f4192650f6bc27e9d1f. As an interim measure where patching cannot be immediately applied, administrators should restrict unprivileged user access on affected embedded/IoT systems and monitor kernel memory consumption for anomalous growth (Red Hat Advisory, Red Hat Bugzilla).