CVE-2026-23422 Linux CVE debrief

Who should care

Users of Linux kernel versions 5.15.200 to 5.15.203, 6.1.163 to 6.1.167, 6.6.124 to 6.6.130, 6.12.70 to 6.12.77, 6.18.10 to 6.18.17, 6.19.1 to 6.19.7, and 7.0 rc1 to rc7 should apply patches to mitigate this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for these Linux kernel versions.

Technical summary

The dpaa2-switch IRQ handler did not properly handle out-of-bounds if_id values, leading to an interrupt storm. The issue was addressed by adding a range check for if_id and clearing the interrupt status when an out-of-bounds value is detected. Multiple Linux kernel versions were affected, including 5.15.200 to 5.15.203, 6.1.163 to 6.1.167, 6.6.124 to 6.6.130, 6.12.70 to 6.12.77, 6.18.10 to 6.18.17, 6.19.1 to 6.19.7, and 7.0 rc1 to rc7. The fix ensures that the interrupt status is cleared after detecting an out-of-bounds if_id to avoid the interrupt storm.

Defensive priority

High

Recommended defensive actions

• Apply patches from Linux kernel stable branches
• Inventory and update affected Linux kernel versions
• Monitor system logs for interrupt storm indicators
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-03T14:16:28.320Z and last modified on 2026-07-14T13:18:33.890Z. The NVD entry is currently Modified. This issue was identified through experimental AI code review at Google. The dpaa2-switch IRQ handler did not properly handle out-of-bounds if_id values. Multiple Linux kernel versions were affected, including 5.15.200 to 5.15.203, 6.1.163 to 6.1.167, 6.6.124 to 6.6.130, 6.12.70 to 6.12.77, 6.18.10 to 6.18.17, 6.19.1 to 6.19.7, and 7.0 rc1 to rc7.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.