CVE-2026-23013
BaseFortify
Publication date: 2026-01-25
Last updated on: 2026-04-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.9 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.7 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.9.1 (inc) to 6.12.67 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's octeon_ep_vf driver where an error in handling IRQ (interrupt request) rollback leads to a mismatch in the device identifier (dev_id) used when freeing IRQs. Specifically, when request_irq() fails part-way, free_irq() is called with a different dev_id than originally used, which can leave IRQ handlers registered incorrectly. This can cause use-after-free errors or crashes when interrupts fire later.
How can this vulnerability impact me? :
The impact of this vulnerability is that it can cause use-after-free conditions or crashes in the Linux kernel when interrupts occur. This can lead to system instability, potential denial of service, or unpredictable behavior due to improper IRQ handler cleanup.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by correcting the free_irq dev_id mismatch in the Linux kernel's octeon_ep_vf driver. To mitigate this vulnerability, update your Linux kernel to a version that includes the fix for this issue, as described in the patch that ensures free_irq is called with the correct dev_id matching the original request_irq call.