PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23443 Linux CVE debrief

A use-after-free vulnerability was found in the Linux kernel. After a previous fix for acpi_processor_errata_piix4(), device pointers may be dereferenced after dropping references to the device objects pointed to by them, which may cause a use-after-free to occur. Moreover, debug messages about enabling the errata may be printed if the errata flags corresponding to them are unset. Address all of these issues by moving message printing to the points in the code where the errata flags are set. This vulnerability affects Linux kernel versions 6.1.165 to 6.1.167, 6.6.128 to 6.6.130, 6.12.75 to 6.12.78, 6.18.16 to 6.18.20, and 6.19.6 to 6.19.10, and 5.15.202.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-07-24
Advisory published
2026-04-03
Advisory updated
2026-07-24

Who should care

Users of Linux kernel versions 6.1.165 to 6.1.167, 6.6.128 to 6.6.130, 6.12.75 to 6.12.78, 6.18.16 to 6.18.20, and 6.19.6 to 6.19.10, and 5.15.202 should be aware of this vulnerability. System administrators and security teams responsible for Linux kernel-based systems should assess their configurations and apply necessary patches or mitigations.

Technical summary

The vulnerability is caused by a use-after-free error in the acpi_processor_errata_piix4() function. This function is part of the ACPI processor driver in the Linux kernel. The issue arises when device pointers are dereferenced after the references to the device objects they point to have been dropped. This can lead to unexpected behavior or crashes. Additionally, there is an issue with debug messages being printed even when the corresponding errata flags are not set. The fix involves moving the printing of messages to where the errata flags are set, ensuring that messages are only printed when the flags are actually set.

Defensive priority

Medium

Recommended defensive actions

  • Inventory and assess Linux kernel versions in use
  • Apply patches from kernel.org
  • Monitor system logs for unusual activity
  • Consider compensating controls such as SELinux or AppArmor
  • Review system configurations for potential exposure
  • Track exceptions and retest remediated assets
  • Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record was published on 2026-04-03T16:16:28.573Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. This vulnerability affects Linux kernel versions 6.1.165 to 6.1.167, 6.6.128 to 6.6.130, 6.12.75 to 6.12.78, 6.18.16 to 6.18.20, and 6.19.6 to 6.19.10, and 5.15.202. Users should verify their system configurations and apply patches or mitigations as recommended by the Linux kernel community.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-23443 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-23443

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-23443 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23443

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2e369ba9eb7b8a06e9cc35a3e7fe73e59272f8c2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/68408e8f9e366ad9850a66ac65cb569f13bf6cd4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8583f62259e1b315d5239371adfb36939cdab741

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/98473309a36acc271009b85e0bb53a4c0dddf5c2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bf504b229cb8d534eccbaeaa23eba34c05131e25

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e0c470049344e9346fff79d7e2362212c216665e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/edf4c2aaee08e8fd503fbae705c801e92a0b55d7

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.