CVE-2026-99023

What it actually does

Failure to free the consumers array allocated by of_regulator_bulk_get_all() in pwrseq-pcie-m2.c results in a kernel memory leak each time the power sequencing driver initializes.

Why it matters to the business

Long-running Linux systems may experience gradual memory exhaustion, leading to reduced performance, instability, or eventual crashes that disrupt services and require reboots.

How an attack unfolds

An attacker with local access or the ability to trigger repeated device probe events can cause the leak to accumulate; no remote unauthenticated exploitation path is known and EPSS remains low.

How to fix it

Update to a Linux kernel containing the commit that adds kfree() for the consumers array returned by of_regulator_bulk_get_all() in drivers/power/sequencing/pwrseq-pcie-m2.c.

How to confirm the fix worked

Verify the presence of the kfree() call after of_regulator_bulk_get_all() in the pwrseq-pcie-m2 source; confirm the running kernel is newer than the vulnerable commit and test that repeated driver probes no longer increase memory usage.

Typical attack path

1. Obtain local access or ability to trigger PCIe M.2 device enumeration
2. Repeatedly load or probe the pwrseq-pcie-m2 driver
3. Allow the unfreed allocations to accumulate over time
4. Observe system-wide memory pressure or OOM conditions

How to detect it

Inspect kernel memory statistics over time for unexplained growth correlated with PCIe device events; review dmesg or kernel logs for repeated regulator bulk allocation messages without corresponding frees.

What your security team should do

• Prioritize kernel updates on systems using PCIe M.2 power sequencing within the next maintenance window
• Monitor memory usage trends on affected hosts
• Review downstream distribution kernels for backported fixes