CVE-2026-23432: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23432 is a use-after-free (UAF) vulnerability in the Linux kernel's mshv (Microsoft Hyper-V) module, specifically in the error path of the mshv_map_user_memory() function. When an error occurs in this function, calling vfree() directly on the memory region leaves the MMU notifier registered; if userspace subsequently unmaps the memory, the notifier fires and accesses the already-freed region, potentially causing a kernel panic. The vulnerability affects Linux kernel versions 6.19 through 6.19.9 and 7.0-rc1 through 7.0-rc4. It was published on April 3, 2026, with patches available by April 23, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory).

The root cause is classified as CWE-416 (Use After Free). In the error path of mshv_map_user_memory(), the original code called vfree() directly to release the memory region, but this did not unregister the associated MMU notifier. When userspace later unmaps the memory, the MMU notifier callback fires and dereferences the already-freed region pointer, resulting in a use-after-free condition. The fix replaces vfree() with mshv_partition_put(), which properly unregisters the MMU notifier before freeing the region. Exploitation requires local access with low privileges — an attacker must be able to call mshv_map_user_memory(), trigger an error condition, and then unmap the relevant memory (GitHub Advisory, Kernel Patch 1).

Successful exploitation can lead to kernel panic, memory corruption, and potential privilege escalation on affected systems. A low-privileged local attacker could leverage this vulnerability to corrupt kernel memory, potentially gaining elevated privileges or causing a denial of service through a kernel crash. The vulnerability is confined to systems running the mshv module (Microsoft Hyper-V guest environments on Linux), limiting its scope to that specific deployment context (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018–0.019%, placing it in the 6th percentile for exploitation likelihood within 30 days. Exploitation requires local access with low privileges, which limits the attack surface compared to remotely exploitable vulnerabilities (GitHub Advisory).

Update the Linux kernel to version 6.19.10 or later (for the 6.19.x stable branch), or to 7.0-rc5 or later (for the 7.0 release candidate series). The fix is available in two upstream commits: 34861bdc and 6922db25. Systems not using the mshv (Microsoft Hyper-V) kernel module are not affected and do not require immediate action. Administrators running affected kernel versions in Hyper-V guest environments should prioritize patching (GitHub Advisory).