CVE-2026-23137 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux kernel versions 3.18 to 6.18.6 and 6.19-rc1 to 6.19-rc4 should verify and update affected versions. The vulnerability can cause denial of service, and verification of Linux kernel versions is necessary to prevent the memory leak.

Why it matters

Memory leak vulnerability in Linux kernel can cause denial of service. Linux kernel developers and maintainers should verify and update affected versions.

• Memory leak can cause denial of service
• Verification of Linux kernel versions is necessary

Technical summary

The Linux kernel's unittest_data_add() function has a memory leak vulnerability. If of_resolve_phandles() fails, the allocated unittest_data is not freed. This issue is resolved by using a scope-based cleanup helper __free(kfree) for automatic resource cleanup. The fix prevents memory leaks in the Linux kernel's unittest_data_add() function by ensuring that unittest_data is automatically freed when it goes out of scope in error paths. Affected users should update to Linux kernel version 6.18.7 or later to prevent the vulnerability.

Defensive priority

Apply patch or update to Linux kernel version 6.18.7 or later to prevent memory leak

Recommended defensive actions

• Apply patch or update to Linux kernel version 6.18.7 or later
• Review and update Linux kernel versions 3.18 to 6.18.6
• Verify Linux kernel versions 6.19-rc1 to 6.19-rc4 for vulnerability
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the memory leak vulnerability in the Linux kernel. The official CVE Program record and NIST NVD detail page offer source-provided CVE metadata and vulnerability assessment. The vulnerability has been resolved in Linux kernel version 6.18.7 or later. Users of affected Linux kernel versions should apply the patch or update to prevent the memory leak.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.