CVE-2026-23464: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23464 is a memory leak vulnerability in the Linux kernel's Microchip PolarFire SoC (MPFS) system controller driver. In the mpfs_sys_controller_probe() function, if of_get_mtd_device_by_node() fails, the function returns immediately without freeing the allocated memory for sys_controller; a similar issue exists in the mbox_request_channel() error path. The vulnerability was published on April 3, 2026, and affects Linux kernel versions 6.8 through 6.12.77, 6.13 through 6.18.19, 6.19 through 6.19.9, and 7.0-rc1 through 7.0-rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime): when mpfs_sys_controller_probe() encounters an error from of_get_mtd_device_by_node(), it returns directly without jumping to the out_free cleanup label, leaving the sys_controller allocation unreleased. The same deficiency exists in the mbox_request_channel() failure path. The fix consolidates all error handling to use the out_free label, ensuring memory is properly deallocated on any probe failure. Exploitation requires local access with low privileges, as the vulnerability is triggered during kernel driver probe operations on systems using Microchip MPFS SoC hardware (GitHub Advisory).

The primary impact is on system availability: repeated probe failures without memory cleanup cause gradual kernel memory exhaustion on affected Microchip MPFS platforms. Over time, this can degrade system stability and, in resource-constrained environments, potentially lead to out-of-memory conditions. There is no confidentiality or integrity impact associated with this vulnerability (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (4th percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory, Feedly).

Update the Linux kernel to a patched version: 6.12.78 or later (for the 6.12 stable branch), 6.18.20 or later (for the 6.18 branch), 6.19.10 or later (for the 6.19 branch), or 7.0-rc5 or later. Patches are available via the upstream kernel stable tree. For systems that cannot be immediately updated, restrict or monitor probe operations on Microchip MPFS SoC platforms and watch for signs of kernel memory exhaustion. Distribution-specific kernel updates should be applied as they become available (GitHub Advisory, Feedly).