Skip to main content

Linux CVE-2026-23260

| EUVDEUVD-2026-12894 MEDIUM
Memory Leak (CWE-401)
2026-03-18 Linux
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-401
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
Impact

Without a published CVSS vector, EPSS score, or KEV status, the real-world risk assessment relies on structural analysis. The vulnerability is classified as a memory leak (CWE-401) with local attack vector characteristics, as exploitation would require the ability to trigger repeated mas_store_gfp() failures through register cache write operations. The technical impact is denial of service through kernel memory exhaustion rather than privilege escalation or information disclosure. The presence of four distinct stable kernel patches (visible in the git commit references) indicates this was treated as a real issue warranting backports, but the lack of an assigned CVSS or EPSS score and the absence of mentions regarding active exploitation suggest this is a reliability/robustness issue rather than a high-severity security vulnerability. This appears to be a moderate-priority fix aligned with defensive coding practices rather than a critical exploit vector, though kernel memory exhaustion DoS scenarios merit attention in resource-constrained environments.
Exploit ScenarioDerived

A local attacker with ability to trigger register cache write operations (typically requiring direct hardware access or specific device driver access) could cause repeated mas_store_gfp() failures by crafting malicious register map write requests or by inducing memory pressure conditions. With each failed write, a kernel memory block leaks, and over time this leads to kernel memory exhaustion, causing the system to become unresponsive or crash. This scenario is most applicable to embedded Linux systems, IoT devices, or cloud environments where kernel memory is constrained and register cache operations are frequently invoked by user-accessible device drivers.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 18, 2026

A memory leak vulnerability exists in the Linux kernel's regmap maple tree caching implementation where allocated memory is not freed when the mas_store_gfp() function fails during a write operation. This affects all Linux kernel versions containing the vulnerable regcache_maple_write() function, potentially allowing local attackers to exhaust kernel memory through repeated cache write failures. While no CVSS score or EPSS data is currently available, the vulnerability has been assigned CVE-2026-23260 and multiple stable kernel patches are available, indicating this is a recognized and actively addressed issue.

RemediationAI

Update the Linux kernel to a version containing one of the published patches (commits d61171cf097156030142643942c217759a9cc806, 811b45e2d795d955bb7fd9c816b40036f4fde350, f08f2d2907675926ac5657b25f86d921f269602a, or f3f380ce6b3d5c9805c7e0b3d5bc28d9ec41e2e8 from https://git.kernel.org/stable/). The fix involves adding explicit memory deallocation for the 'entry' variable on the mas_store_gfp() failure path before returning the error. For systems unable to immediately apply kernel updates, monitor kernel memory usage and watch for signs of memory pressure in the regmap subsystem, and consider limiting register cache write operations if feasible in your hardware configuration. The patches are available through standard Linux distribution kernel update mechanisms.

Affected VersionsENISA

Linux patch: 6.19
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <811b45e2d795d955bb7fd9c816b40036f4fde350
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <d61171cf097156030142643942c217759a9cc806
Linux patch: 6.6.124
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <f3f380ce6b3d5c9805c7e0b3d5bc28d9ec41e2e8
Linux patch: 6.12.70
Linux patch: 6.18.10
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <f08f2d2907675926ac5657b25f86d921f269602a

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the regmap (register map) subsystem of the Linux kernel, specifically in the maple tree-based register cache implementation (regcache_maple_write function). The regmap framework provides an abstraction layer for hardware register access, with caching mechanisms to optimize I/O operations. The maple tree is a modern data structure used for efficient range management in the kernel. When regcache_maple_write() attempts to merge adjacent register ranges, it allocates a new memory block ('entry') and attempts to store it using mas_store_gfp(). The root cause is improper error handling (CWE-401: Missing Release of Memory After Effective Lifetime) where the newly allocated entry is not freed when mas_store_gfp() fails, while the code correctly frees previously replaced neighbor blocks ('lower' and 'upper') on the success path. This affects the Linux kernel across all versions implementing this vulnerable pattern, as identified by CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
May 29, 2026 - 19:07 NVD
5.5 (MEDIUM)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 18, 2026 - 17:41 nvd
N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

regmap: maple: free entry on mas_store_gfp() failure

regcache_maple_write() allocates a new block ('entry') to merge adjacent ranges and then stores it with mas_store_gfp(). When mas_store_gfp() fails, the new 'entry' remains allocated and is never freed, leaking memory.

Free 'entry' on the failure path; on success continue freeing the replaced neighbor blocks ('lower', 'upper').

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Linux Kernel I/O and Data Structure Fixes

View all 4
CVE-2026-23263
CVE-2026-23261 MEDIUM
5.5
CVE-2026-23259 MEDIUM
5.5

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2025-25469 HIGH POC
8.8
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

Debian

linux
Release Status Fixed Version Urgency
bullseye vulnerable 5.10.223-1 -
bullseye (security) vulnerable 5.10.251-1 -
bookworm vulnerable 6.1.159-1 -
bookworm (security) vulnerable 6.1.164-1 -
trixie fixed 6.12.73-1 -
trixie (security) fixed 6.12.74-2 -
forky fixed 6.19.6-2 -
sid fixed 6.19.8-1 -
(unstable) fixed 6.18.10-1 -

SUSE

Severity: Medium
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.145 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.132 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.162 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.132 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.176 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.125 Affected
Image SLES-Azure-Basic Image SLES-EC2 Image SLES-Hardened-BYOS-Azure Image SLES-SAPCAL-Azure Affected
SUSE Linux Micro 6.2 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23260 ADVISORY https://ubuntu.com/security/notices/USN-8278-1 ADVISORY https://vuldb.com/?id.351578 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21834/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21841/ REF https://git.kernel.org/stable/c/811b45e2d795d955bb7fd9c816b40036f4fde350 REF https://git.kernel.org/stable/c/d61171cf097156030142643942c217759a9cc806 REF https://git.kernel.org/stable/c/f08f2d2907675926ac5657b25f86d921f269602a REF https://git.kernel.org/stable/c/f3f380ce6b3d5c9805c7e0b3d5bc28d9ec41e2e8

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy