CVE-2026-23023

What it actually does

The flaw is a memory leak in the idpf driver where vport->rx_ptype_lkup allocated via kmalloc is never freed in idpf_vport_rel() during reset paths, allowing repeated allocations without corresponding deallocation.

Why it matters to the business

Affected Linux systems using the idpf driver may suffer gradual memory exhaustion after repeated vport resets, leading to degraded performance or availability issues; the low EPSS and lack of KEV status indicate limited immediate urgency but still require timely patching given the kernel's widespread use.

How an attack unfolds

An attacker with local access triggers repeated idpf vport initialization and release cycles (via resets or interface flaps) to accumulate unreferenced 4KB allocations reported by kmemleak; no named threat actors or ransomware campaigns are associated.

How to fix it

Upgrade to fixed package versions including linux-virt 6.12.27-r0 or apply the upstream commit a4212d6732e3f674c6cc7d0b642f276d827e8f94; ensure the free of rx_ptype_lkup is present in idpf_vport_rel().

How to confirm the fix worked

Confirm the kernel version matches a fixed release or inspect the idpf source to verify the memory free operation exists in the vport release function; re-run kmemleak after resets to check for absence of the reported leak object.

Typical attack path

1. Gain local user access on a system running the affected idpf driver
2. Induce multiple vport resets through interface configuration changes or driver reloads
3. Observe progressive memory depletion via system monitoring tools

How to detect it

Scan kernel logs and kmemleak output for unreferenced objects allocated in idpf_send_get_rx_ptype_msg; track unexplained growth in slab memory usage associated with network driver worker threads.

What your security team should do

• Apply the listed fixed versions or commit to all affected systems as soon as possible
• Monitor memory consumption on hosts using the idpf driver until patches are deployed
• Review change logs for any idpf-related resets in production workloads