CVE-2026-23443: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23443 is a use-after-free vulnerability in the Linux kernel's ACPI processor module, specifically within the acpi_processor_errata_piix4() function. It was introduced by a prior fix (commit f132e089fe89) intended to address a NULL-pointer dereference, but inadvertently allowed device pointers to be dereferenced after their reference counts were dropped. The vulnerability was disclosed on April 3, 2026, and affects specific stable kernel versions across multiple branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference) in the advisory, but the functional flaw is a use-after-free (UAF) condition: after commit f132e089fe89, device pointers in acpi_processor_errata_piix4() may be dereferenced after the reference to the underlying device object has been released, creating a dangling pointer scenario. Additionally, debug messages related to errata enablement could be printed even when the corresponding errata flags were not set, indicating improper control flow. The fix restructures the code to move message printing to the points where errata flags are actually set, eliminating both the UAF and the spurious debug output. Exploitation requires local access with low privileges (GitHub Advisory, Feedly).

A local attacker with low privileges could trigger the use-after-free condition in the ACPI processor subsystem, potentially leading to memory corruption at the kernel level. Successful exploitation could result in a system denial of service (kernel crash) or, in more sophisticated scenarios, privilege escalation to kernel-level code execution. Confidentiality and integrity impacts are not directly implied by the CVSS scoring, but memory corruption primitives in kernel space can be chained for further exploitation (Feedly).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (GitHub Advisory, Feedly).

Patches are available across multiple Linux kernel stable branches. Administrators should update to the following fixed versions based on their kernel branch:

• 6.1.x: upgrade to 6.1.167+
• 6.6.x: upgrade to 6.6.130+
• 6.12.x: upgrade to 6.12.78+
• 6.18.x: upgrade to 6.18.20+
• 6.19.x: upgrade to 6.19.10+
• 7.0: fixed in 7.0-rc5

Specific fix commits include 2e369ba9eb7b, 68408e8f9e36, 8583f62259e1, 98473309a36a, bf504b229cb8, e0c470049344, and edf4c2aaee08. For systems that cannot be updated immediately, restrict local user privileges and limit access to ACPI-related kernel interfaces. Monitor kernel logs for ACPI processor-related memory errors (GitHub Advisory, Feedly).

Vendor security teams at SUSE, Amazon Linux, and the Yocto Project have issued advisories and updates addressing this vulnerability. Tenable has published Nessus detection plugins (IDs 311335, 311340, 314333, 318589) and pipeline issue trackers for this CVE. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking (SUSE Advisory, Amazon Linux Advisory, Tenable).