CVE-2026-23452: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23452 is a race condition vulnerability in the Linux kernel's runtime power management (PM) subsystem that can lead to a use-after-free memory access. The flaw exists in pm_runtime_work(), which may dereference a dev->parent pointer after the parent device has been freed during concurrent device removal. It affects Linux kernel versions from 2.6.32 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, and 6.19.10. Disclosed on April 3, 2026, it carries a CVSS v3.1 base score of 4.7 (Medium) (GitHub Advisory, Feedly).

The root cause is improper synchronization (CWE-362 — Race Condition) between the pm_runtime_work() workqueue handler and the device removal path. When a child device is being removed and its parent device is concurrently freed, the code in pm_runtime_work() attempts to acquire the parent's spinlock and call rpm_idle() on the already-freed parent structure, resulting in a slab-use-after-free condition. The fix inserts a flush_work() call in pm_runtime_remove() to ensure any pending PM work items referencing the device complete before the parent structure is released. The bug was reproducible via the blktest block/001 test, which triggered a KASAN report showing a read of freed memory at lock_acquire+0x70/0x160 in the pm workqueue (GitHub Advisory).

Successful exploitation can cause a kernel crash (system unavailability) due to the use-after-free memory access, with a high availability impact and no confidentiality or integrity impact under the current CVSS assessment. A local unprivileged user with the ability to trigger device removal or hot-plug operations (e.g., via sysfs writes) could exploit this race condition to destabilize or crash the system. In more complex scenarios, use-after-free conditions in kernel memory can potentially be leveraged for privilege escalation or arbitrary code execution, though no such exploitation has been demonstrated for this specific vulnerability (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.024% (3rd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and high attack complexity due to the timing-dependent nature of the race condition (GitHub Advisory, Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing BUG: KASAN: slab-use-after-free messages referencing lock_acquire or rpm_idle in the pm workqueue context.
• Logs: Stack traces involving pm_runtime_work, rpm_idle, rpm_suspend, and process_one_work in kernel crash or KASAN reports.
• Process: Unexpected kernel worker thread (kworker) crashes or hangs associated with the pm workqueue.
• System: Sporadic system instability or kernel panics during device hot-plug or removal operations, particularly involving SCSI targets or block devices.

Apply the upstream Linux kernel patch that adds a flush_work() call in pm_runtime_remove() to synchronize device removal with pending PM workqueue items. Fixed versions include: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, and 6.19.10. Distribution-specific updates are available from Amazon Linux (ALAS2023-2026-1594, ALAS2023-2026-1681, ALAS2KERNEL-5.15-2026-102), SUSE (SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), Debian, and openSUSE. As a workaround where patching is not immediately possible, restrict unprivileged user access to device removal and hot-plug operations via sysfs (GitHub Advisory, Feedly).