CVE-2026-23029

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23029", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.942Z", "datePublished": "2026-01-31T11:42:07.750Z", "dateUpdated": "2026-05-11T21:58:37.718Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:58:37.718Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy()\n\nIn kvm_ioctl_create_device(), kvm_device has allocated memory,\nkvm_device->destroy() seems to be supposed to free its kvm_device\nstruct, but kvm_eiointc_destroy() is not currently doing this, that\nwould lead to a memory leak.\n\nSo, fix it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/loongarch/kvm/intc/eiointc.c"], "versions": [{"version": "2e8b9df82631e714cc2b7bf302772c8259673180", "lessThan": "e94ec9661c5820d157d2cc4b6cf4a6ab656a7b4d", "status": "affected", "versionType": "git"}, {"version": "2e8b9df82631e714cc2b7bf302772c8259673180", "lessThan": "7d8553fc75aefa7ec936af0cf8443ff90b51732e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/loongarch/kvm/intc/eiointc.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.7", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e94ec9661c5820d157d2cc4b6cf4a6ab656a7b4d"}, {"url": "https://git.kernel.org/stable/c/7d8553fc75aefa7ec936af0cf8443ff90b51732e"}], "title": "LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/loongarch/kvm/intc/eiointc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e94ec9661c5820d157d2cc4b6cf4a6ab656a7b4d", "status": "affected", "version": "2e8b9df82631e714cc2b7bf302772c8259673180", "versionType": "git"}, {"lessThan": "7d8553fc75aefa7ec936af0cf8443ff90b51732e", "status": "affected", "version": "2e8b9df82631e714cc2b7bf302772c8259673180", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/loongarch/kvm/intc/eiointc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy()\n\nIn kvm_ioctl_create_device(), kvm_device has allocated memory,\nkvm_device->destroy() seems to be supposed to free its kvm_device\nstruct, but kvm_eiointc_destroy() is not currently doing this, that\nwould lead to a memory leak.\n\nSo, fix it."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nLoongArch: KVM: Correcci\u00f3n de fuga de kvm_device en kvm_eiointc_destroy()\n\nEn kvm_ioctl_create_device(), kvm_device ha asignado memoria, kvm_device->destroy() parece que deber\u00eda liberar su estructura kvm_device, pero kvm_eiointc_destroy() no est\u00e1 haciendo esto actualmente, lo que llevar\u00eda a una fuga de memoria.\n\nPor lo tanto, se corrige."}], "id": "CVE-2026-23029", "lastModified": "2026-06-17T10:20:44.460", "metrics": {}, "published": "2026-01-31T12:16:06.217", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7d8553fc75aefa7ec936af0cf8443ff90b51732e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e94ec9661c5820d157d2cc4b6cf4a6ab656a7b4d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy()", "id": "2435667", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435667"}, "csaw": false, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nLoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy()\nIn kvm_ioctl_create_device(), kvm_device has allocated memory,\nkvm_device->destroy() seems to be supposed to free its kvm_device\nstruct, but kvm_eiointc_destroy() is not currently doing this, that\nwould lead to a memory leak.\nSo, fix it."], "name": "CVE-2026-23029", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-31T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23029\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23029\nhttps://lore.kernel.org/linux-cve-announce/2026013120-CVE-2026-23029-88a9@gregkh/T"]}

{"analysis": {"en": {"generated_at": "2026-04-18T00:54:59.896452+00:00", "value": {"mitigation_remediation": ["Upgrade the Linux kernel to a version that includes the fix (any release that contains commit 7d8553fc75aefa7ec936af0cf8443ff90b51732e).", "If a kernel upgrade is not immediately possible, apply the patch from the kernel repository by cherry\u2011pulling commit 7d8553fc75aefa7ec936af0cf8443ff90b51732e (or its equivalent) into the current kernel tree and recompiling.", "Consider restricting KVM device creation privileges on the host (e.g., limit the use of kvm_ioctl_create_device to trusted users or remove the eiointc device entirely) until the kernel can be updated."], "summary": {"action": "Apply Patch", "impact": "Memory Leak in KVM device creation leading to resource exhaustion"}, "threat_synthesis": {"affected_systems": "All Linux kernel builds that support the LoongArch architecture and include the KVM eiointc device code prior to the patch commit 7d8553fc75aefa7ec936af0cf8443ff90b51732e. The affected product is the Linux kernel (LoongArch variant). Any distribution using a kernel version that has not incorporated this fix is at risk.", "description_and_impact": "The Linux kernel for LoongArch contains a flaw in the KVM subsystem where the kvm_eiointc_destroy routine fails to free the allocated kvm_device structure. When a KVM device is created and subsequently destroyed, the unused memory remains allocated, causing a kernel memory leak. This gradual memory consumption can degrade overall system performance and, if left unchecked, may contribute to a denial\u2011of\u2011service condition by exhausting available kernel memory.", "risk_and_exploitability": "With an EPSS score of less than 1%, the probability of active exploitation is very low and the flaw is not listed in the CISA KEV catalog, indicating no known exploits. The vulnerability does not provide direct remote code execution; the likely attack vector requires an attacker with the privilege to invoke kvm_ioctl_create_device and trigger repeated device creations and deletions, which would exhaust memory over time. Overall, the risk is low but can lead to resource exhaustion if unmitigated."}}}}, "created": "2026-04-18T01:00:11.629020+00:00", "updated": "2026-04-18T01:00:11.629031+00:00", "vendors": [], "weaknesses": ["CWE-401"]}