CVE-2026-23445 Linux CVE debrief

Who should care

System administrators and users of Linux kernel versions 6.10.1 to 6.12.78, 6.13 to 6.18.20, and 6.19 to 6.19.10 should be aware of this vulnerability and apply the necessary patches to prevent potential page faults in the igc driver. Additionally, security teams and operators managing Linux systems should review system configurations and logs for signs of exploitation.

Technical summary

The Linux kernel's igc driver is vulnerable to a page fault issue in XDP TX timestamps handling. When an XDP application shuts down while the interface link is still up, it leaves behind xsk_meta pointers that the IRQ handler tries to access, causing a page fault. The issue is resolved by cleaning up stale xsk meta data on TX shutdown. Affected versions include Linux kernel 6.10.1 to 6.12.78, 6.13 to 6.18.20, and 6.19 to 6.19.10. Defenders should focus on patching and monitoring.

Defensive priority

High

Recommended defensive actions

• Apply patches from Linux kernel stable branches to update the igc driver
• Ensure XDP applications are properly shut down to prevent stale xsk_meta pointers
• Monitor system logs for page faults related to the igc driver
• Update Linux kernel to versions 6.12.79, 6.18.21, or 6.19.11, or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-03T16:16:30.077Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Modified. Evidence is limited to public CVE and NVD information. Defenders should verify system configurations, review logs for page faults related to the igc driver, and ensure XDP applications are properly shut down.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.