CVE-2026-23352

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23352", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.000Z", "datePublished": "2026-03-25T10:27:37.500Z", "dateUpdated": "2026-11-05T21:33:41.778Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:04:35.619Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/efi: defer freeing of boot services memory\n\nefi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE\nand EFI_BOOT_SERVICES_DATA using memblock_free_late().\n\nThere are two issue with that: memblock_free_late() should be used for\nmemory allocated with memblock_alloc() while the memory reserved with\nmemblock_reserve() should be freed with free_reserved_area().\n\nMore acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y\nefi_free_boot_services() is called before deferred initialization of the\nmemory map is complete.\n\nBenjamin Herrenschmidt reports that this causes a leak of ~140MB of\nRAM on EC2 t3a.nano instances which only have 512MB or RAM.\n\nIf the freed memory resides in the areas that memory map for them is\nstill uninitialized, they won't be actually freed because\nmemblock_free_late() calls memblock_free_pages() and the latter skips\nuninitialized pages.\n\nUsing free_reserved_area() at this point is also problematic because\n__free_page() accesses the buddy of the freed page and that again might\nend up in uninitialized part of the memory map.\n\nDelaying the entire efi_free_boot_services() could be problematic\nbecause in addition to freeing boot services memory it updates\nefi.memmap without any synchronization and that's undesirable late in\nboot when there is concurrency.\n\nMore robust approach is to only defer freeing of the EFI boot services\nmemory.\n\nSplit efi_free_boot_services() in two. First efi_unmap_boot_services()\ncollects ranges that should be freed into an array then\nefi_free_boot_services() later frees them after deferred init is complete."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/include/asm/efi.h", "arch/x86/platform/efi/efi.c", "arch/x86/platform/efi/quirks.c", "drivers/firmware/efi/mokvar-table.c"], "versions": [{"version": "0aed459e8487eb6ebdb4efe8cefe1eafbc704b30", "lessThan": "4a2cb90c538f06c873a187aa743575d48685d7a6", "status": "affected", "versionType": "git"}, {"version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "7131bd1fecc749bc94fb44aae217bbd8a8a85264", "status": "affected", "versionType": "git"}, {"version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "6d8ba221e7aafaa2f284b7d22faee814c28e009d", "status": "affected", "versionType": "git"}, {"version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "227688312fece0026fc67a00ba9a0b3611ebe95d", "status": "affected", "versionType": "git"}, {"version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "6a25e25279282c5c8ade554c04c6ab9dc7902c64", "status": "affected", "versionType": "git"}, {"version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "399da820ecfe6f4f10c143e5c453d3559a04db9c", "status": "affected", "versionType": "git"}, {"version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "f9e9cc320854a76a39e7bc92d144554f3a727fad", "status": "affected", "versionType": "git"}, {"version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "7dcf59422a3b0d20ddda844f856b4a1e0608a326", "status": "affected", "versionType": "git"}, {"version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "a4b0bf6a40f3c107c67a24fbc614510ef5719980", "status": "affected", "versionType": "git"}, {"version": "2.6.39.1", "lessThan": "2.6.39.2", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/include/asm/efi.h", "arch/x86/platform/efi/efi.c", "arch/x86/platform/efi/quirks.c", "drivers/firmware/efi/mokvar-table.c"], "versions": [{"version": "3.0", "status": "affected"}, {"version": "0", "lessThan": "3.0", "status": "unaffected", "versionType": "semver"}, {"version": "2.6.39.2", "lessThanOrEqual": "2.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.77", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39.1", "versionEndExcluding": "2.6.39.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.1.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.12.77"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4a2cb90c538f06c873a187aa743575d48685d7a6"}, {"url": "https://git.kernel.org/stable/c/7131bd1fecc749bc94fb44aae217bbd8a8a85264"}, {"url": "https://git.kernel.org/stable/c/6d8ba221e7aafaa2f284b7d22faee814c28e009d"}, {"url": "https://git.kernel.org/stable/c/227688312fece0026fc67a00ba9a0b3611ebe95d"}, {"url": "https://git.kernel.org/stable/c/6a25e25279282c5c8ade554c04c6ab9dc7902c64"}, {"url": "https://git.kernel.org/stable/c/399da820ecfe6f4f10c143e5c453d3559a04db9c"}, {"url": "https://git.kernel.org/stable/c/f9e9cc320854a76a39e7bc92d144554f3a727fad"}, {"url": "https://git.kernel.org/stable/c/7dcf59422a3b0d20ddda844f856b4a1e0608a326"}, {"url": "https://git.kernel.org/stable/c/a4b0bf6a40f3c107c67a24fbc614510ef5719980"}], "title": "x86/efi: defer freeing of boot services memory", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:14:17.020Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23352", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:27:38.508883Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:33:41.778Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:14:17.020Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23352", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:27:38.508883Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:27:39.434Z"}}], "cna": {"title": "x86/efi: defer freeing of boot services memory", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0aed459e8487eb6ebdb4efe8cefe1eafbc704b30", "lessThan": "4a2cb90c538f06c873a187aa743575d48685d7a6", "versionType": "git"}, {"status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "7131bd1fecc749bc94fb44aae217bbd8a8a85264", "versionType": "git"}, {"status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "6d8ba221e7aafaa2f284b7d22faee814c28e009d", "versionType": "git"}, {"status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "227688312fece0026fc67a00ba9a0b3611ebe95d", "versionType": "git"}, {"status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "6a25e25279282c5c8ade554c04c6ab9dc7902c64", "versionType": "git"}, {"status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "399da820ecfe6f4f10c143e5c453d3559a04db9c", "versionType": "git"}, {"status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "f9e9cc320854a76a39e7bc92d144554f3a727fad", "versionType": "git"}, {"status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "7dcf59422a3b0d20ddda844f856b4a1e0608a326", "versionType": "git"}, {"status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "lessThan": "a4b0bf6a40f3c107c67a24fbc614510ef5719980", "versionType": "git"}, {"status": "affected", "version": "2.6.39.1", "lessThan": "2.6.39.2", "versionType": "semver"}], "programFiles": ["arch/x86/include/asm/efi.h", "arch/x86/platform/efi/efi.c", "arch/x86/platform/efi/quirks.c", "drivers/firmware/efi/mokvar-table.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.0"}, {"status": "unaffected", "version": "0", "lessThan": "3.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.6.39.2", "versionType": "semver", "lessThanOrEqual": "2.6.*"}, {"status": "unaffected", "version": "5.10.253", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.167", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.130", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.77", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.17", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.7", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/x86/include/asm/efi.h", "arch/x86/platform/efi/efi.c", "arch/x86/platform/efi/quirks.c", "drivers/firmware/efi/mokvar-table.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/4a2cb90c538f06c873a187aa743575d48685d7a6"}, {"url": "https://git.kernel.org/stable/c/7131bd1fecc749bc94fb44aae217bbd8a8a85264"}, {"url": "https://git.kernel.org/stable/c/6d8ba221e7aafaa2f284b7d22faee814c28e009d"}, {"url": "https://git.kernel.org/stable/c/227688312fece0026fc67a00ba9a0b3611ebe95d"}, {"url": "https://git.kernel.org/stable/c/6a25e25279282c5c8ade554c04c6ab9dc7902c64"}, {"url": "https://git.kernel.org/stable/c/399da820ecfe6f4f10c143e5c453d3559a04db9c"}, {"url": "https://git.kernel.org/stable/c/f9e9cc320854a76a39e7bc92d144554f3a727fad"}, {"url": "https://git.kernel.org/stable/c/7dcf59422a3b0d20ddda844f856b4a1e0608a326"}, {"url": "https://git.kernel.org/stable/c/a4b0bf6a40f3c107c67a24fbc614510ef5719980"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/efi: defer freeing of boot services memory\n\nefi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE\nand EFI_BOOT_SERVICES_DATA using memblock_free_late().\n\nThere are two issue with that: memblock_free_late() should be used for\nmemory allocated with memblock_alloc() while the memory reserved with\nmemblock_reserve() should be freed with free_reserved_area().\n\nMore acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y\nefi_free_boot_services() is called before deferred initialization of the\nmemory map is complete.\n\nBenjamin Herrenschmidt reports that this causes a leak of ~140MB of\nRAM on EC2 t3a.nano instances which only have 512MB or RAM.\n\nIf the freed memory resides in the areas that memory map for them is\nstill uninitialized, they won't be actually freed because\nmemblock_free_late() calls memblock_free_pages() and the latter skips\nuninitialized pages.\n\nUsing free_reserved_area() at this point is also problematic because\n__free_page() accesses the buddy of the freed page and that again might\nend up in uninitialized part of the memory map.\n\nDelaying the entire efi_free_boot_services() could be problematic\nbecause in addition to freeing boot services memory it updates\nefi.memmap without any synchronization and that's undesirable late in\nboot when there is concurrency.\n\nMore robust approach is to only defer freeing of the EFI boot services\nmemory.\n\nSplit efi_free_boot_services() in two. First efi_unmap_boot_services()\ncollects ranges that should be freed into an array then\nefi_free_boot_services() later frees them after deferred init is complete."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.6.39.2", "versionStartIncluding": "2.6.39.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.253", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.203", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.167", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.130", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.77", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.17", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.7", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "3.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:04:35.619Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23352", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:33:41.778Z", "dateReserved": "2026-01-13T15:37:46.000Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-03-25T10:27:37.500Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/include/asm/efi.h", "arch/x86/platform/efi/efi.c", "arch/x86/platform/efi/quirks.c", "drivers/firmware/efi/mokvar-table.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4a2cb90c538f06c873a187aa743575d48685d7a6", "status": "affected", "version": "0aed459e8487eb6ebdb4efe8cefe1eafbc704b30", "versionType": "git"}, {"lessThan": "7131bd1fecc749bc94fb44aae217bbd8a8a85264", "status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "versionType": "git"}, {"lessThan": "6d8ba221e7aafaa2f284b7d22faee814c28e009d", "status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "versionType": "git"}, {"lessThan": "227688312fece0026fc67a00ba9a0b3611ebe95d", "status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "versionType": "git"}, {"lessThan": "6a25e25279282c5c8ade554c04c6ab9dc7902c64", "status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "versionType": "git"}, {"lessThan": "399da820ecfe6f4f10c143e5c453d3559a04db9c", "status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "versionType": "git"}, {"lessThan": "f9e9cc320854a76a39e7bc92d144554f3a727fad", "status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "versionType": "git"}, {"lessThan": "7dcf59422a3b0d20ddda844f856b4a1e0608a326", "status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "versionType": "git"}, {"lessThan": "a4b0bf6a40f3c107c67a24fbc614510ef5719980", "status": "affected", "version": "916f676f8dc016103f983c7ec54c18ecdbb6e349", "versionType": "git"}, {"lessThan": "2.6.39.2", "status": "affected", "version": "2.6.39.1", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/include/asm/efi.h", "arch/x86/platform/efi/efi.c", "arch/x86/platform/efi/quirks.c", "drivers/firmware/efi/mokvar-table.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.0"}, {"lessThan": "3.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "2.6.*", "status": "unaffected", "version": "2.6.39.2", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.167", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.77", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.17", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D9DAAC1B-DEB7-46CC-B206-48044C143468", "versionEndExcluding": "5.10.253", "versionStartIncluding": "3.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2EDC6BAF-B710-4E26-B6AA-D68922EE7B43", "versionEndExcluding": "6.1.167", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B3D12E00-E42D-4056-B354-BAD4903C03A5", "versionEndExcluding": "6.12.77", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5E006E4-59C7-43C1-9231-62A72219F2BA", "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.39.1:*:*:*:*:*:*:*", "matchCriteriaId": "1713DDF4-33F1-4716-84D7-FCFECCF9BCCA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.0:-:*:*:*:*:*:*", "matchCriteriaId": "2E4912EC-CC92-41CA-A2DA-027291975A84", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/efi: defer freeing of boot services memory\n\nefi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE\nand EFI_BOOT_SERVICES_DATA using memblock_free_late().\n\nThere are two issue with that: memblock_free_late() should be used for\nmemory allocated with memblock_alloc() while the memory reserved with\nmemblock_reserve() should be freed with free_reserved_area().\n\nMore acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y\nefi_free_boot_services() is called before deferred initialization of the\nmemory map is complete.\n\nBenjamin Herrenschmidt reports that this causes a leak of ~140MB of\nRAM on EC2 t3a.nano instances which only have 512MB or RAM.\n\nIf the freed memory resides in the areas that memory map for them is\nstill uninitialized, they won't be actually freed because\nmemblock_free_late() calls memblock_free_pages() and the latter skips\nuninitialized pages.\n\nUsing free_reserved_area() at this point is also problematic because\n__free_page() accesses the buddy of the freed page and that again might\nend up in uninitialized part of the memory map.\n\nDelaying the entire efi_free_boot_services() could be problematic\nbecause in addition to freeing boot services memory it updates\nefi.memmap without any synchronization and that's undesirable late in\nboot when there is concurrency.\n\nMore robust approach is to only defer freeing of the EFI boot services\nmemory.\n\nSplit efi_free_boot_services() in two. First efi_unmap_boot_services()\ncollects ranges that should be freed into an array then\nefi_free_boot_services() later frees them after deferred init is complete."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nx86/efi: aplazar la liberaci\u00f3n de la memoria de servicios de arranque\n\nefi_free_boot_services() libera la memoria ocupada por EFI_BOOT_SERVICES_CODE y EFI_BOOT_SERVICES_DATA usando memblock_free_late().\n\nHay dos problemas con eso: memblock_free_late() deber\u00eda usarse para la memoria asignada con memblock_alloc() mientras que la memoria reservada con memblock_reserve() deber\u00eda liberarse con free_reserved_area().\n\nM\u00e1s agudamente, con CONFIG_DEFERRED_STRUCT_PAGE_INIT=y efi_free_boot_services() se llama antes de que se complete la inicializaci\u00f3n diferida del mapa de memoria.\n\nBenjamin Herrenschmidt informa que esto causa una fuga de ~140MB de RAM en instancias EC2 t3a.nano que solo tienen 512MB de RAM.\n\nSi la memoria liberada reside en las \u00e1reas cuyo mapa de memoria a\u00fan no est\u00e1 inicializado, no se liberar\u00e1n realmente porque memblock_free_late() llama a memblock_free_pages() y esta \u00faltima omite las p\u00e1ginas no inicializadas.\n\nUsar free_reserved_area() en este punto tambi\u00e9n es problem\u00e1tico porque __free_page() accede al 'buddy' de la p\u00e1gina liberada y eso de nuevo podr\u00eda terminar en una parte no inicializada del mapa de memoria.\n\nRetrasar todo efi_free_boot_services() podr\u00eda ser problem\u00e1tico porque adem\u00e1s de liberar la memoria de servicios de arranque, actualiza efi.memmap sin ninguna sincronizaci\u00f3n y eso es indeseable tarde en el arranque cuando hay concurrencia.\n\nUn enfoque m\u00e1s robusto es aplazar solo la liberaci\u00f3n de la memoria de servicios de arranque EFI.\n\nDividir efi_free_boot_services() en dos. Primero, efi_unmap_boot_services() recopila los rangos que deber\u00edan liberarse en un array, luego efi_free_boot_services() los libera m\u00e1s tarde una vez que la inicializaci\u00f3n diferida est\u00e1 completa."}], "id": "CVE-2026-23352", "lastModified": "2026-11-05T22:18:16.540", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23352", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:27:38.508883Z", "version": "2.0.3"}}]}, "published": "2026-03-25T11:16:33.627", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/227688312fece0026fc67a00ba9a0b3611ebe95d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/399da820ecfe6f4f10c143e5c453d3559a04db9c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4a2cb90c538f06c873a187aa743575d48685d7a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6a25e25279282c5c8ade554c04c6ab9dc7902c64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6d8ba221e7aafaa2f284b7d22faee814c28e009d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7131bd1fecc749bc94fb44aae217bbd8a8a85264"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7dcf59422a3b0d20ddda844f856b4a1e0608a326"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a4b0bf6a40f3c107c67a24fbc614510ef5719980"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f9e9cc320854a76a39e7bc92d144554f3a727fad"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: x86/efi: defer freeing of boot services memory", "id": "2451178", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451178"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-763", "details": ["A flaw was found in the Linux kernel. During system startup, when the kernel attempts to free memory used by EFI (Extensible Firmware Interface) boot services, it may fail to properly release these memory regions. This occurs because the memory freeing process is initiated before the system's memory map is fully initialized. The consequence is a memory leak, which can lead to a denial of service by consuming available system resources."], "name": "CVE-2026-23352", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23352\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23352\nhttps://lore.kernel.org/linux-cve-announce/2026032537-CVE-2026-23352-18f2@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0aed459e8487eb6ebdb4efe8cefe1eafbc704b30,4a2cb90c538f06c873a187aa743575d48685d7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[916f676f8dc016103f983c7ec54c18ecdbb6e349,227688312fece0026fc67a00ba9a0b3611ebe95d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[916f676f8dc016103f983c7ec54c18ecdbb6e349,6a25e25279282c5c8ade554c04c6ab9dc7902c64)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[916f676f8dc016103f983c7ec54c18ecdbb6e349,399da820ecfe6f4f10c143e5c453d3559a04db9c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[916f676f8dc016103f983c7ec54c18ecdbb6e349,f9e9cc320854a76a39e7bc92d144554f3a727fad)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[916f676f8dc016103f983c7ec54c18ecdbb6e349,7dcf59422a3b0d20ddda844f856b4a1e0608a326)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[916f676f8dc016103f983c7ec54c18ecdbb6e349,a4b0bf6a40f3c107c67a24fbc614510ef5719980)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[2.6.39.2,2.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.167,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.77,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.17,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T17:07:14.909190+00:00", "value": {"mitigation_remediation": ["Apply the kernel patch that splits efi_free_boot_services into efi_unmap_boot_services and efi_free_boot_services, resolving the memory leak.", "If a patch cannot be applied immediately, temporarily disable the CONFIG_DEFERRED_STRUCT_PAGE_INIT kernel configuration option to avoid improper memory freeing during boot.", "Monitor system memory usage during boot on low\u2011memory nodes to ensure boot services memory is released correctly."], "summary": {"action": "Apply Patch", "impact": "Memory Exhaustion"}, "threat_synthesis": {"affected_systems": "Any machine running the Linux kernel on an x86 system that utilizes UEFI boot services and has the CONFIG_DEFERRED_STRUCT_PAGE_INIT option enabled is affected. The CPE indicates the Linux kernel as the impacted product, and no specific kernel version is listed. The issue is inherent to the EFI subsystem of the kernel rather than a particular distribution.", "description_and_impact": "The Linux kernel contains a flaw in the EFI boot services memory release routine, where allocated boot\u2011service memory is freed using memblock_free_late() instead of free_reserved_area(). This misuse can cause a leak of approximately 140\u202fMB of RAM on systems with limited memory, such as EC2 t3a.nano instances, leading to memory exhaustion and potentially a system crash. The weakness is a Memory Management issue, classified as CWE\u2011401 (Memory Leak) and CWE\u2011763 (Memory Exhaustion).", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1\u202f% shows a very low projected exploitation probability. Based on the description, it is inferred that the vulnerability can only be exploited during the early boot phase, requiring local access to the machine\u2019s boot process, and no remote attack vector is explicitly documented. Therefore, while the risk is limited to memory\u2011constrained environments, the bug can degrade performance or cause a denial of service once sufficient memory is consumed."}}}}, "created": "2026-03-25T21:32:03.121383+00:00", "updated": "2026-04-28T17:15:21.242464+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}