CVE-2026-23046
BaseFortify
Publication date: 2026-02-04
Last updated on: 2026-02-04
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's virtio_net driver where there is a device mismatch during memory allocation and deallocation.
Specifically, the initial allocation of rss_hdr uses virtio_device->device, but the freeing of this memory in virtnet_set_queues() uses net_device->device instead.
This mismatch causes a devres warning and can lead to improper resource management within the kernel.
The fix involved consistently using virtio_device->device for both allocation and deallocation to prevent this mismatch.
How can this vulnerability impact me? :
This vulnerability can cause warnings related to device resource management in the kernel, which may indicate improper handling of allocated memory.
While the description does not explicitly mention security impacts such as crashes or privilege escalation, improper resource management can potentially lead to system instability or unexpected behavior.
Therefore, the impact may include kernel warnings, possible resource leaks, or instability in systems using the affected virtio_net driver.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a device mismatch warning in the Linux kernel logs related to virtio_net. You can detect it by checking the kernel log messages for specific devres warnings.
- Use the command: dmesg | grep 'WARNING: drivers/base/devres.c' to search for the devm_kfree warning messages.
- Look for log entries similar to: 'WARNING: drivers/base/devres.c:1095 at devm_kfree+0x84/0x98' and references to virtio_net or vdpa modules.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by ensuring consistent use of virtio_device->device for both allocation and deallocation in the virtio_net driver.
Immediate mitigation steps include updating your Linux kernel to a version that contains the fix for this issue.
If updating the kernel is not immediately possible, monitor kernel logs for the warning and avoid using affected virtio_net configurations that trigger the issue.