CVE-2026-23422: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23422 is a vulnerability in the Linux kernel's dpaa2-switch network driver that can cause an interrupt storm when a malformed or out-of-bounds interface ID (if_id) is received in the IRQ handler. The flaw was introduced as a side effect of commit 31a7a0bbeb00, which added bounds checking for if_id to prevent out-of-bounds memory access but failed to clear the interrupt status register upon detecting an invalid if_id, leaving the interrupt line asserted indefinitely. It was discovered by an experimental AI code review agent at Google and disclosed on April 3, 2026. Affected Linux kernel versions include 5.15.200–5.15.202, 6.1.163–6.1.166, 6.6.124–6.6.129, 6.12.70–6.12.76, 6.18.10–6.18.16, 6.19.1–6.19.6, and 7.0-rc1 through rc7. The CVSS v3.1 base score is 7.8 (High) (Feedly, GitHub Advisory, Red Hat CVE).

The root cause is classified under CWE-392 (Missing Report of Error Condition) and CWE-787 (Out-of-bounds Write). In the dpaa2-switch IRQ handler, when an incoming if_id value falls outside the valid range, the handler returns early to avoid an out-of-bounds array access — but does so without clearing the hardware interrupt status register. Because the interrupt line remains asserted, the CPU re-enters the handler in a tight loop, producing an interrupt storm. The fix requires explicitly clearing the interrupt status register even in the error path when an out-of-bounds if_id is detected. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction (Feedly, GitHub Advisory).

Successful exploitation results in an interrupt storm that causes severe system performance degradation and potential system crashes, constituting a denial-of-service condition. The vulnerability primarily affects availability, though the CVSS score also reflects high confidentiality and integrity impact (likely due to the potential for memory corruption via the underlying out-of-bounds write path). Systems running affected Linux kernel versions with dpaa2-switch-capable NXP DPAA2 network hardware are at risk (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges on a system equipped with dpaa2-switch-capable hardware (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing repeated IRQ handler invocations or messages related to dpaa2-switch with invalid if_id values; high interrupt counts on the dpaa2-switch IRQ line visible via /proc/interrupts.
• System Behavior: Sudden and sustained CPU utilization spike attributed to interrupt handling (softirq/hardirq), system becoming unresponsive or sluggish without obvious user-space cause.
• Network: Unusual or malformed Ethernet frames arriving on dpaa2-switch interfaces with crafted or invalid interface identifiers.

Update the Linux kernel to one of the following patched versions: 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, or 7.0-rc3 (and later). Multiple patch commits are available in the Linux kernel stable tree. As a temporary workaround for systems that cannot be immediately patched, consider disabling or restricting access to dpaa2-switch network interfaces if they are not actively required, and implement network segmentation to limit exposure. Monitor system logs for signs of interrupt storms or unusual CPU utilization (Feedly, GitHub Advisory).

The vulnerability was notably discovered by an experimental AI code review agent at Google, which was highlighted in the CVE description as a demonstration of AI-assisted vulnerability discovery in open-source kernel code. No significant public researcher commentary or media coverage beyond standard vulnerability tracking has been observed (Feedly).