CVE-2026-23387: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23387 is a double-free (double-put) vulnerability in the Linux kernel's pinctrl: cirrus: cs42l43 driver. The flaw exists in the cs42l43_pin_probe() function, where devm_add_action_or_reset() already invokes the cleanup action on failure, but the code also performs an explicit put(), resulting in a double release of the same resource (CWE-415 / CWE-1341). It affects Linux kernel versions across multiple stable branches, with fixed versions including 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc3. The vulnerability was published on March 25, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Feedly).

The root cause is a double-free condition (CWE-415 / CWE-1341: Multiple Releases of Same Resource or Handle) in the cs42l43_pin_probe() function within the drivers/pinctrl/cirrus/pinctrl-cs42l43.c file of the Linux kernel. When devm_add_action_or_reset() fails, it automatically invokes the registered cleanup action (which calls put() on the resource); however, the surrounding error-handling code also explicitly calls put(), resulting in the resource being released twice. Exploitation requires local access with low privileges, as an attacker would need to trigger the error path in the driver probe function — for example, by manipulating device initialization conditions. No public proof-of-concept exploit code has been identified (Red Hat CVE, Feedly).

Successful exploitation of this double-free vulnerability can lead to kernel memory corruption, potentially resulting in system crashes, kernel panics, and denial of service. Beyond availability impact, memory corruption of this nature can also be leveraged for information disclosure (confidentiality impact) or to corrupt kernel data structures (integrity impact). The vulnerability is locally exploitable by a low-privileged user, limiting its scope to systems where an attacker already has local access, but the high CVSS impact scores across all three CIA pillars reflect the severity of kernel-level memory corruption (Feedly, Red Hat CVE).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability has an EPSS score of approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack vector is local, requiring low privileges, which further constrains the practical exploitability of this flaw (Feedly, Red Hat CVE).

Patches are available in the Linux kernel stable repositories. Administrators should upgrade to one of the following fixed kernel versions: 6.6.130 or later, 6.12.77 or later, 6.18.17 or later, 6.19.7 or later, or 7.0-rc3 or later. As an interim measure, restricting local user access to affected systems reduces exposure. Monitoring for unexpected kernel crashes or panics may serve as an indicator of attempted exploitation. Apply patches as part of the regular kernel update cycle, prioritizing systems with broader local user access (Red Hat CVE, Kernel Patch 1, Kernel Patch 2).

Red Hat has tracked this vulnerability and published a CVE advisory page. The Yocto Project security mailing list and openSUSE security announcements have also referenced this CVE in the context of kernel update advisories. No significant researcher commentary or notable media coverage has been identified beyond standard vulnerability database entries (Red Hat CVE, openSUSE Advisory).