CVE-2026-23445: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23445 is a page fault vulnerability in the Linux kernel's igc network driver affecting XDP TX timestamps handling. When an XDP application that requested TX timestamping shuts down while the network interface link remains active, stale xsk_meta pointers are left in the TX ring, causing the IRQ handler to access dangling pointers and trigger a kernel panic. Affected kernel versions include 6.10.1 through 6.12.77, 6.13 through 6.18.19, 6.19 through 6.19.9, and 7.0-rc1 through 7.0-rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly). The vulnerability was published on April 3, 2026.

The root cause is improper cleanup of xsk_meta pointers during TX ring shutdown in the igc driver (Intel I225/I226 Ethernet). When an XDP socket application terminates while the network link is still up, the TX ring teardown path fails to nullify or free the associated xsk_meta metadata pointers. Subsequently, when a TX timestamp interrupt fires, the igc_ptp_tx_tstamp_event() function (called from igc_tsync_interrupt()) dereferences these now-invalid pointers, resulting in a BUG: unable to handle page fault kernel splat. The fix cleans up stale XSK metadata during TX ring shutdown. No CWE classification has been formally assigned, but the issue is consistent with a use-after-free or dangling pointer dereference pattern. Exploitation requires local access and low privileges — specifically the ability to run an XDP application on a system using the igc driver (GitHub Advisory).

Successful triggering of this vulnerability results in a kernel panic (denial of service), causing the affected system to crash or become unresponsive. There is no confidentiality or integrity impact — only availability is affected, as the crash occurs in kernel interrupt context. The scope is limited to the local system running the igc driver with an active XDP timestamping application; lateral movement or data exfiltration are not applicable to this vulnerability (GitHub Advisory, Feedly).

• Logs: Kernel log entries containing BUG: unable to handle page fault for address: followed by a call trace referencing igc_ptp_tx_tstamp_event and igc_tsync_interrupt in the igc module.
• Process: Unexpected system reboots or kernel panics on hosts using Intel I225/I226 NICs (igc driver) coinciding with XDP application lifecycle events (startup/shutdown).
• System: Kernel crash dumps (vmcore) or kdump artifacts generated during igc interrupt handling, identifiable by the stack trace pattern igc_ptp_tx_tstamp_event+0xdf/0x160 [igc].

Update to a patched Linux kernel version: 6.12.78 or later, 6.18.20 or later, 6.19.10 or later, or 7.0-rc5 or later. Patch commits are available at git.kernel.org (commits 31521c1, 45b33e8, 5e4c90c, b02fa17d). Vendor-specific updates are available via SUSE (SUSE-SU-202621834-1, SUSE-SU-20262217-1, SUSE-SU-20262238-1) and Amazon Linux 2023 (ALAS2023-2026-1594). As a temporary workaround where patching is not immediately possible, avoid running XDP applications with TX timestamping on systems using the igc driver, or ensure the network interface is brought down before terminating such applications (GitHub Advisory, Feedly).

The vulnerability was noted by VulDB and discussed briefly on Infosec.exchange shortly after publication. The Yocto Project security mailing list flagged the issue for embedded Linux distributions. No significant vendor statements beyond patch releases or notable researcher commentary have been identified (Feedly).