CVE-2026-23024

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23024", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.941Z", "datePublished": "2026-01-31T11:39:07.604Z", "dateUpdated": "2026-05-11T21:58:31.817Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:58:31.817Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix memory leak of flow steer list on rmmod\n\nThe flow steering list maintains entries that are added and removed as\nethtool creates and deletes flow steering rules. Module removal with active\nentries causes memory leak as the list is not properly cleaned up.\n\nPrevent this by iterating through the remaining entries in the list and\nfreeing the associated memory during module removal. Add a spinlock\n(flow_steer_list_lock) to protect the list access from multiple threads."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/idpf/idpf.h", "drivers/net/ethernet/intel/idpf/idpf_ethtool.c", "drivers/net/ethernet/intel/idpf/idpf_lib.c"], "versions": [{"version": "ada3e24b84a097b27a823f1ad98e5b2e8c979689", "lessThan": "1aedff70a5e97628eaaf17b169774cb6a45a1dc5", "status": "affected", "versionType": "git"}, {"version": "ada3e24b84a097b27a823f1ad98e5b2e8c979689", "lessThan": "f9841bd28b600526ca4f6713b0ca49bf7bb98452", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/idpf/idpf.h", "drivers/net/ethernet/intel/idpf/idpf_ethtool.c", "drivers/net/ethernet/intel/idpf/idpf_lib.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.6", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1aedff70a5e97628eaaf17b169774cb6a45a1dc5"}, {"url": "https://git.kernel.org/stable/c/f9841bd28b600526ca4f6713b0ca49bf7bb98452"}], "title": "idpf: fix memory leak of flow steer list on rmmod", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/idpf/idpf.h", "drivers/net/ethernet/intel/idpf/idpf_ethtool.c", "drivers/net/ethernet/intel/idpf/idpf_lib.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1aedff70a5e97628eaaf17b169774cb6a45a1dc5", "status": "affected", "version": "ada3e24b84a097b27a823f1ad98e5b2e8c979689", "versionType": "git"}, {"lessThan": "f9841bd28b600526ca4f6713b0ca49bf7bb98452", "status": "affected", "version": "ada3e24b84a097b27a823f1ad98e5b2e8c979689", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/idpf/idpf.h", "drivers/net/ethernet/intel/idpf/idpf_ethtool.c", "drivers/net/ethernet/intel/idpf/idpf_lib.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8F0BAC72-4991-44BB-A7D4-90D634550955", "versionEndExcluding": "6.18.6", "versionStartIncluding": "6.17.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*", "matchCriteriaId": "7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*", "matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix memory leak of flow steer list on rmmod\n\nThe flow steering list maintains entries that are added and removed as\nethtool creates and deletes flow steering rules. Module removal with active\nentries causes memory leak as the list is not properly cleaned up.\n\nPrevent this by iterating through the remaining entries in the list and\nfreeing the associated memory during module removal. Add a spinlock\n(flow_steer_list_lock) to protect the list access from multiple threads."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nidpf: corrige una fuga de memoria de la lista de direcci\u00f3n de flujo al desinstalar el m\u00f3dulo\n\nLa lista de direcci\u00f3n de flujo mantiene entradas que se a\u00f1aden y eliminan a medida que ethtool crea y elimina reglas de direcci\u00f3n de flujo. La eliminaci\u00f3n del m\u00f3dulo con entradas activas provoca una fuga de memoria ya que la lista no se limpia correctamente.\n\nEsto se evita iterando a trav\u00e9s de las entradas restantes en la lista y liberando la memoria asociada durante la eliminaci\u00f3n del m\u00f3dulo. Se a\u00f1ade un spinlock (flow_steer_list_lock) para proteger el acceso a la lista de m\u00faltiples hilos."}], "id": "CVE-2026-23024", "lastModified": "2026-06-17T10:20:43.913", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-01-31T12:16:05.720", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1aedff70a5e97628eaaf17b169774cb6a45a1dc5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f9841bd28b600526ca4f6713b0ca49bf7bb98452"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: idpf: fix memory leak of flow steer list on rmmod", "id": "2435654", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435654"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-23024", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-31T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23024\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23024\nhttps://lore.kernel.org/linux-cve-announce/2026013137-CVE-2026-23024-5861@gregkh/T"], "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-18T18:38:54.279232+00:00", "value": {"mitigation_remediation": ["Upgrade the kernel to a version that includes the fix (e.g., the latest 6.19 release candidate or a stable release that incorporates the patch).", "Reboot the system to ensure the updated kernel is active. ", "If frequent module removal is required, clear all flow steering entries before unloading the module to avoid the leak until the patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Memory Leak"}, "threat_synthesis": {"affected_systems": "This issue affects the Linux kernel, specifically versions 6.17 and 6.19 from release candidate 1 up through release candidate 8. All distributions using these kernel releases are impacted, as the vulnerability is present in the core kernel source regardless of vendor customizations.", "description_and_impact": "The Linux kernel idpf module contains a flaw where the flow steering list is not cleared when the module is removed while entries remain. The list holds pointers to memory that must be freed, and their omission causes a persistent memory leak that can grow over time. The cumulative leak can exhaust kernel address space, potentially leading to system instability or a denial\u2011of\u2011service condition. The weakness is improper deallocation of dynamically allocated memory (CWE-401).", "risk_and_exploitability": "With a CVSS score of 5.5 the vulnerability is considered medium severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires local access to unload the idpf module while flow steering entries are still active; no remote attack vector is identified. The practical impact is a gradual deterioration of kernel memory availability that could terminate processes or lead to kernel panics if left unchecked."}}}}, "created": "2026-04-18T18:45:05.755991+00:00", "updated": "2026-04-18T18:45:05.756017+00:00", "vendors": []}