CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel()
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix memory leak in idpfvportrel()
Free vport->rxptypelkup in idpfvportrel() to avoid leaking memory during a reset. Reported by kmemleak:
unreferenced object 0xff450acac838a000 (size 4096): comm "kworker/u258:5", pid 7732, jiffies 4296830044 hex dump (first 32 bytes): 00 00 00 00 00 10 00 00 00 10 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 ................ backtrace (crc 3da81902): kmalloccachenoprof+0x469/0x7a0 idpfsendgetrxptypemsg+0x90/0x570 [idpf] idpfinittask+0x1ec/0x8d0 [idpf] processonework+0x226/0x6d0 workerthread+0x19e/0x340 kthread+0x10f/0x250 retfromfork+0x251/0x2b0 retfromforkasm+0x1a/0x30
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the Linux kernel idpf driver, free vport->rx_ptype_lkup in idpf_vport_rel() to prevent the memory leak during a reset.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23023?
CVE-2026-23023 is classified as a low severity vulnerability due to the memory leak it introduces.
How do I fix CVE-2026-23023?
To fix CVE-2026-23023, you need to update your Linux kernel to the version that includes the patch for the memory leak.
What systems are affected by CVE-2026-23023?
CVE-2026-23023 affects the Linux kernel related to idpf, particularly versions that involve virtual port management.
What impact does CVE-2026-23023 have on systems?
The impact of CVE-2026-23023 includes potential memory exhaustion over time due to leaking memory during resets.
How was CVE-2026-23023 discovered?
CVE-2026-23023 was discovered through kmemleak, which reported the unreferenced memory object related to the vulnerability.