CVE-2026-23421 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems who apply kernel updates should be aware of this vulnerability and take necessary actions to update their kernel versions. The vulnerability has been publicly disclosed and patched, and affected systems should be updated to prevent potential memory leaks.

Technical summary

The vulnerability exists in the drm/xe/configfs component of the Linux kernel. Specifically, the ctx_restore_mid_bb memory is allocated in wa_bb_store() but not freed in xe_config_device_release(). This results in a memory leak when the configfs device is removed. The fix involves adding a call to free ctx_restore_mid_bb[0].cs. The vulnerability affects kernel versions 6.18.1 to 6.18.17, 6.19 to 6.19.7, and various 7.0 release candidates.

Defensive priority

Apply kernel updates or patches to fix the memory leak vulnerability. Review the official patches and update Linux kernel versions accordingly.

Recommended defensive actions

• Apply the official patches provided by the Linux kernel maintainers.
• Update Linux kernel to a version that includes the fix.
• Review and update Linux distribution packages to ensure the fix is included.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-04-03T14:16:28.190Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. This memory leak vulnerability in the Linux kernel's drm/xe/configfs component was reported by a third-party researcher. The vulnerability has been publicly disclosed and patched. Linux kernel developers and maintainers should review the official patches and update their kernel versions accordingly. The vulnerability affects kernel versions 6.18.1 to 6.18.17, 6.19 to 6.19.7, and various 7.0 release candidates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.