CVE-2026-23453: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23453 is a memory leak vulnerability in the Linux kernel's TI ICSSG PRUETH (Industrial Communications SubSystem General Purpose - PRU Ethernet) driver affecting XDP packet processing in non-zero-copy mode. The flaw was disclosed on April 3, 2026, and affects Linux kernel versions 6.19 through 6.19.10 (exclusive), as well as 7.0-rc1 through 7.0-rc4. Patches were released targeting kernel 6.19.10 and 7.0-rc5. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). Page recycling was removed from the XDP_DROP path in emac_run_xdp() to avoid conflicts with AF_XDP zero-copy mode, which uses xsk_buff_free() for cleanup. However, in standard page pool (non-zero-copy) mode, this omission means pages are never returned to the page pool when packets are dropped, causing a progressive memory leak. The fix moves cleanup responsibility to the caller emac_rx_packet(), which now recycles pages back to the pool when emac_run_xdp() returns ICSSG_XDP_CONSUMED for XDP_DROP actions (GitHub Advisory).

Successful exploitation leads to a denial-of-service condition through out-of-memory (OOM) exhaustion. An unauthenticated remote attacker can trigger XDP packet drop operations on the affected network interface, causing pages to continuously leak from the page pool until system memory is exhausted. There is no confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), placing it in the 19th percentile for exploitation likelihood within 30 days (GitHub Advisory).

Apply the Linux kernel patches that fix the memory leak in emac_rx_packet(). Fixed commits are available at 719d3e71691db7c4f1658ba5a6d1472928121594 (targeting kernel 6.19.10) and d16d57dedcb69c1a1257e0638f8698ce1f0ccbe5 (targeting 7.0-rc5). As an interim workaround, consider disabling XDP packet processing on interfaces using the TI ICSSG PRUETH driver, or monitor system memory usage closely on affected embedded systems running this driver with XDP enabled (GitHub Advisory).