CVE-2026-23319 Linux CVE debrief

Who should care

This vulnerability affects Linux kernel versions 6.0.1 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7, and 7.0 rc1 to rc7. Users of these versions should apply patches or mitigations to prevent exploitation. Linux kernel users and administrators should review and apply patches or mitigations.

Technical summary

The vulnerability is caused by a use-after-free condition in the bpf_trampoline_link_cgroup_shim function. When the refcount of 'shim_link->link.link' reaches zero, the resource is considered released but may still be referenced via 'tr->progs_hlist' in 'cgroup_shim_find'. To fix this, an atomic non-zero check was added in 'bpf_trampoline_link_cgroup_shim' to only increment the refcount if it is not already zero. The fix involves adding an atomic non-zero check in 'bpf_trampoline_link_cgroup_shim'.

Defensive priority

High

Recommended defensive actions

• Apply patches from Linux kernel stable branches
• Inventory and update affected Linux kernel versions
• Monitor for suspicious activity related to bpf_trampoline_link_cgroup_shim
• Implement compensating controls to limit exploitation
• Verify and retest systems after patch application
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-03-25T11:16:28.570Z and last modified on 2026-07-14T13:18:29.743Z. The NVD entry is currently Modified. This vulnerability affects Linux kernel versions 6.0.1 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7, and 7.0 rc1 to rc7. Users of these versions should apply patches or mitigations to prevent exploitation. The vulnerability is caused by a use-after-free condition in the bpf_trampoline_link_cgroup_shim function.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.