CVE-2026-23005 Linux CVE debrief

Who should care

Administrators and users of Linux systems, particularly those using kernel versions prior to the patched versions, should be aware of this vulnerability and take steps to mitigate it. This includes updating to the latest kernel version, monitoring system logs for signs of exploitation, and implementing compensating controls.

Technical summary

The Linux kernel's x86/fpu component fails to clear XSTATE_BV[i] in guest XSAVE state when XFD[i]=1. This vulnerability allows a local attacker to cause a denial of service by triggering a kernel panic. The issue arises when the kernel attempts to load state for features disabled via the guest's XFD. The vulnerability is addressed in kernel versions 5.17.1, 6.1.162, 6.6.122, 6.7, 6.12.67, 6.13, 6.18.7, and later. It has a CVSS score of 5.5 and a medium severity level. To mitigate this vulnerability, administrators should update to the latest kernel version, monitor system logs for signs of exploitation, and implement compensating controls. The vulnerability can be triggered by a local attacker with access to the system.

Defensive priority

Medium

Recommended defensive actions

• Apply patches from Linux kernel maintainers
• Update to kernel versions 5.17.1, 6.1.162, 6.6.122, 6.7, 6.12.67, 6.13, 6.18.7, or later
• Monitor system logs for signs of exploitation
• Implement compensating controls, such as restricting access to sensitive resources
• Review system configurations and ensure that they are in line with security best practices
• Perform regular security audits and vulnerability assessments
• Keep software and systems up-to-date with the latest security patches

Evidence notes

The vulnerability is documented in the Linux kernel's Git repository and has been assigned a CVE identifier. The NVD entry provides additional information on the vulnerability, including its CVSS score and affected products. The vulnerability has been patched, and users are advised to update to the latest kernel version.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.