CVE-2026-23420: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23420 is a locking bug in the Linux kernel's wlcore WiFi driver where wl->mutex can be unlocked without first being properly locked, constituting an improper locking flaw. The vulnerability was disclosed on April 3, 2026, and affects multiple Linux kernel stable branches from 4.19 through pre-release 7.0-rc builds. Affected version ranges include kernels from 4.19.1 through 5.10.252, 5.11 through 5.15.202, 5.16 through 6.1.166, 6.2 through 6.6.129, 6.7 through 6.12.76, 6.13 through 6.18.16, and 6.19 through 6.19.6. It carries a CVSS v3.1 base score of 5.5 (Medium), with high availability impact and local attack vector (Red Hat CVE, GitHub Advisory).

The root cause is classified under CWE-832 (Unlock of a Resource that is not Locked) and CWE-667 (Improper Locking). In the wlcore WiFi driver, a code path attempts to release wl->mutex without having acquired it first, a flaw detected by the Clang thread-safety analyzer. This synchronization failure can lead to race conditions (mapped to CAPEC-26: Leveraging Race Conditions) in the WiFi subsystem, potentially causing undefined kernel behavior. Exploitation requires local access with low privileges and no user interaction (Red Hat CVE, GitHub Advisory).

Successful exploitation of this vulnerability can cause data corruption, deadlocks, or instability within the WiFi subsystem, resulting in a denial of service for users relying on wlcore-based WiFi connectivity. The impact is limited to availability (rated HIGH) with no confidentiality or integrity impact, and the scope is unchanged, meaning the vulnerability does not enable privilege escalation or lateral movement beyond the affected WiFi driver subsystem (Red Hat CVE, GitHub Advisory).

Patches are available across multiple Linux kernel stable branches. Users should upgrade to one of the following fixed versions based on their current kernel series: 5.10.253+, 5.15.203+, 6.1.167+, 6.6.130+, 6.12.77+, 6.18.17+, 6.19.7+, or 7.0-rc3+. Patch commits are available via the kernel stable tree on git.kernel.org. Distributions including Debian, SUSE, and Alibaba Cloud Linux have issued security advisories incorporating these fixes (Red Hat CVE, SUSE Advisory, GitHub Advisory).

The vulnerability received routine coverage from Linux distribution security teams, including SUSE, Debian, and Alibaba Cloud Linux, all of which issued security updates incorporating the fix. No notable researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking and distribution advisories (SUSE Advisory).