CVE-2026-23090
Reference Leak Vulnerability in Linux Kernel Slimbus Core
Publication date: 2026-02-04
Last updated on: 2026-03-17
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 5.11 (inc) to 5.15.199 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.162 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.122 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.68 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.8 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 4.16 (inc) to 5.10.249 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's slimbus core component. It involves a device reference leak related to handling 'report present' messages. Slimbus devices can be dynamically allocated when such messages are received. The issue arises because the system does not properly drop the reference taken when looking up already registered devices, potentially causing a reference leak. Fixing this requires managing references carefully, including taking an extra reference if the device has not yet been registered and must be allocated.
How can this vulnerability impact me? :
A device reference leak in the Linux kernel could lead to resource management issues such as memory leaks or exhaustion of device references. Over time, this might degrade system stability or performance, potentially causing crashes or unexpected behavior in systems relying on slimbus devices.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know