CVE-2026-23352: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23352 is a memory leak vulnerability in the Linux kernel's x86 EFI boot services memory handling, specifically in the efi_free_boot_services() function. It affects systems with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y enabled, where the function is called before deferred initialization of the memory map is complete, causing EFI boot services memory to not be properly released. Affected Linux kernel versions span from 3.0.1 through multiple stable branches up to (but not including) fixed releases: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, and 6.19.7, as well as Linux kernel 7.0 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper memory deallocation (CWE-763: Release of Invalid Pointer or Reference; CWE-401: Missing Release of Memory after Effective Lifetime) in efi_free_boot_services(), which incorrectly uses memblock_free_late() to free EFI_BOOT_SERVICES_CODE and EFI_BOOT_SERVICES_DATA memory regions that were reserved via memblock_reserve() and should instead be freed with free_reserved_area(). When CONFIG_DEFERRED_STRUCT_PAGE_INIT=y is active, efi_free_boot_services() executes before deferred memory map initialization completes; memblock_free_late() internally calls memblock_free_pages(), which silently skips pages whose memory map entries are still uninitialized, resulting in those pages never being returned to the allocator. The fix splits the function into efi_unmap_boot_services() (which collects ranges to be freed) and a deferred efi_free_boot_services() that performs the actual freeing only after deferred initialization is complete (Red Hat Bugzilla).

The primary impact is an availability degradation due to permanent RAM loss — on memory-constrained systems such as AWS EC2 t3a.nano instances (512 MB total RAM), approximately 140 MB of physical memory is permanently leaked at boot time and never returned to the OS allocator. This reduces available memory for workloads, degrades system performance, and can trigger out-of-memory (OOM) conditions leading to process termination or system instability. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS A:H, C:N, I:N) (Red Hat Advisory, Red Hat Bugzilla).

Update the Linux kernel to a patched version: 5.10.253 or later, 5.15.203 or later, 6.1.167 or later, 6.6.130 or later, 6.12.77 or later, 6.18.17 or later, or 6.19.7 or later. Systems running Azure Linux with kernel 6.6.126.1-1 should apply the Microsoft security update. Amazon Linux 2023 users should apply the ALAS2023-2026-1543 or later advisory. As a temporary workaround, disabling CONFIG_DEFERRED_STRUCT_PAGE_INIT in the kernel configuration (if a custom kernel build is feasible) would prevent the race condition, though this is not practical for most production environments. Prioritize patching on memory-constrained cloud instances where the ~140 MB leak represents a significant fraction of total RAM (Red Hat Bugzilla, Microsoft MSRC).

The vulnerability was reported by Benjamin Herrenschmidt, who identified the ~140 MB RAM leak on AWS EC2 t3a.nano instances, prompting the upstream kernel fix. Red Hat triaged the issue at low severity/priority, and it has been tracked across multiple distribution security teams including Debian, Amazon Linux, and Microsoft Azure Linux. No significant broader media coverage or social media discussion has been observed beyond standard distribution security advisory channels.