CVE-2026-23090
Unknown Unknown - Not Provided

Reference Leak Vulnerability in Linux Kernel Slimbus Core

Publication date: 2026-02-04

Last updated on: 2026-03-17

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: slimbus: core: fix device reference leak on report present Slimbus devices can be allocated dynamically upon reception of report-present messages. Make sure to drop the reference taken when looking up already registered devices. Note that this requires taking an extra reference in case the device has not yet been registered and has to be allocated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-04
Last Modified
2026-03-17
Generated
2026-07-06
AI Q&A
2026-02-04
EPSS Evaluated
2026-07-05
NVD
CVE-2026-23090

Affected Vendors & Products

Showing 12 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel From 5.11 (inc) to 5.15.199 (exc)
linux linux_kernel From 5.16 (inc) to 6.1.162 (exc)
linux linux_kernel From 6.2 (inc) to 6.6.122 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.68 (exc)
linux linux_kernel From 6.13 (inc) to 6.18.8 (exc)
linux linux_kernel 6.19
linux linux_kernel From 4.16 (inc) to 5.10.249 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's slimbus core component. It involves a device reference leak related to handling 'report present' messages. Slimbus devices can be dynamically allocated when such messages are received. The issue arises because the system does not properly drop the reference taken when looking up already registered devices, potentially causing a reference leak. Fixing this requires managing references carefully, including taking an extra reference if the device has not yet been registered and must be allocated.

Impact Analysis

A device reference leak in the Linux kernel could lead to resource management issues such as memory leaks or exhaustion of device references. Over time, this might degrade system stability or performance, potentially causing crashes or unexpected behavior in systems relying on slimbus devices.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23090. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart