CVE-2026-23022 Details
Description
In the Linux kernel, the following vulnerability has been resolved: idpf: fix memory leak in idpf_vc_core_deinit() Make sure to free hw->lan_regs. Reported by kmemleak during reset: unreferenced object 0xff1b913d02a936c0 (size 96): comm "kworker/u258:14", pid 2174, jiffies 4294958305 hex dump (first 32 bytes): 00 00 00 c0 a8 ba 2d ff 00 00 00 00 00 00 00 00 ......-......... 00 00 40 08 00 00 00 00 00 00 25 b3 a8 ba 2d ff ..@.......%...-. backtrace (crc 36063c4f): __kmalloc_noprof+0x48f/0x890 idpf_vc_core_init+0x6ce/0x9b0 [idpf] idpf_vc_event_task+0x1fb/0x350 [idpf] process_one_work+0x226/0x6d0 worker_thread+0x19e/0x340 kthread+0x10f/0x250 ret_from_fork+0x251/0x2b0 ret_from_fork_asm+0x1a/0x30
A memory leak vulnerability has been identified in the Intel IDPF (Infrastructure Data Plane Framework) driver of the Linux kernel. This issue arises in the 'idpf_vc_core_deinit' function, where the 'lan_regs' memory region is not properly freed, leading to unreferenced objects. The vulnerability was reported by 'kmemleak' during a reset operation, indicating that the leaked memory was not reclaimed. The issue has been addressed by ensuring that the 'lan_regs' are freed before the function completes, preventing the memory leak.
Users can apply the latest patches from the Linux kernel stable tree to address this vulnerability. The specific commit that resolves the issue is 'e111cbc4adf9f9974eed040aeece7e17460f6bff', which is available in the Linux kernel Git repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/23391db8a00c23854915b8b72ec1aa10080aa540 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e111cbc4adf9f9974eed040aeece7e17460f6bff | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.17.1, < 6.18.6 6.17 - 6.19 rc1 6.19 rc2 6.19 rc3 6.19 rc4 6.19 rc5 6.19 rc6 6.19 rc7 6.19 rc8 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Mar 25, 2026 | Initial Analysis | [email protected] |
| Jan 31, 2026 | New CVE Received | kernel.org |