CVE-2026-23344: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23344 is a use-after-free vulnerability in the Linux kernel's CCP (Cryptographic Coprocessor) driver, specifically within the sev_tsm_init_locked() function. In the error path of this function, a pr_err() statement attempts to access structure fields (t->tio_en and t->tio_init_done) after the pointer t has already been freed via kfree(), constituting an expired pointer dereference. The vulnerability was disclosed on March 25, 2026, and was identified by the Smatch static analyzer. Affected versions include Linux kernel 6.19.1 through 6.19.6 and 7.0-rc1 through 7.0-rc7. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference). In sev_tsm_init_locked(), when an error condition is encountered during SEV (Secure Encrypted Virtualization) TSM initialization, the code calls kfree(t) to release the allocated structure, but then proceeds to dereference t->tio_en and t->tio_init_done in a subsequent pr_err() logging call. The fix is straightforward: move the pr_err() call to before the kfree(t) invocation so that the memory is still valid when accessed. Exploitation requires local access with low privileges, targeting the crypto subsystem's error handling path (Red Hat Bugzilla, Feedly).

A local attacker with low-level privileges can trigger this vulnerability by inducing error conditions during SEV TSM initialization, potentially causing kernel crashes (denial of service), memory corruption, or — depending on memory layout and subsequent operations — arbitrary code execution in kernel context. Successful exploitation could result in high confidentiality, integrity, and availability impacts on the affected system. The vulnerability is confined to systems running the affected kernel versions with the CCP driver and SEV support enabled (Feedly).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of disclosure. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Nessus plugin 304106 (Feedly, Tenable).

The vulnerability is fixed in Linux kernel version 6.19.7 and later (for the 6.19.x stable branch) and 7.0-rc3 and later (for development versions). Patches are available via the stable kernel repositories at git.kernel.org (commits 79a26fe3175b9ed7c0c9541b197cb9786237c0f7 and 889b0e2721e793eb46cf7d17b965aa3252af3ec8). As an interim measure on systems that cannot be immediately patched, administrators should restrict local user access to cryptographic subsystem functionality and monitor for unexpected kernel crashes or anomalous behavior related to SEV or CCP operations (Red Hat Bugzilla, Feedly).