CVE-2026-23024: Linux Kernel idpf Memory Leak Vulnerability

CVE-2026-23024 Overview

A memory leak vulnerability has been identified in the Linux kernel's idpf (Intel Data Plane Function) driver. The flaw exists in the flow steering list management, where entries are added and removed as ethtool creates and deletes flow steering rules. When the module is removed while active entries remain in the list, memory is not properly cleaned up, resulting in a memory leak condition.

Critical Impact

Improper memory management in the idpf driver can lead to memory exhaustion, potentially causing system instability or denial of service conditions on affected Linux systems.

Affected Products

• Linux kernel with idpf driver module
• Systems utilizing Intel Data Plane Function network interfaces
• Linux distributions with affected kernel versions

Discovery Timeline

• 2026-01-31 - CVE CVE-2026-23024 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-23024

Vulnerability Analysis

The vulnerability resides in the idpf driver's flow steering list implementation. The flow steering feature allows network administrators to configure hardware-based packet filtering rules through the ethtool utility. Each rule creates an entry in an internal linked list maintained by the driver.

The root issue is that when the kernel module is unloaded via rmmod, the driver fails to iterate through and free all remaining entries in the flow steering list. This results in orphaned memory allocations that persist until system reboot.

The fix addresses this by implementing proper cleanup logic that iterates through all remaining entries in the flow steering list during module removal and frees the associated memory. Additionally, a spinlock (flow_steer_list_lock) has been added to protect list access from race conditions when multiple threads attempt concurrent access.

Root Cause

The memory leak occurs due to insufficient cleanup handling in the module removal path. The original implementation did not account for scenarios where flow steering rules remain active when the module is unloaded. Without proper iteration and deallocation of list entries, kernel memory is leaked with each module unload cycle.

Attack Vector

The vulnerability has an unknown attack vector classification. While the memory leak itself requires local access to trigger module unload operations, repeated exploitation could lead to memory exhaustion. An attacker with sufficient privileges to load and unload kernel modules could potentially abuse this flaw to degrade system performance or cause denial of service through memory resource exhaustion.

The exploitation would typically involve:

1. Loading the idpf module
2. Creating flow steering rules via ethtool
3. Unloading the module without removing the rules
4. Repeating the process to gradually exhaust available memory

Detection Methods for CVE-2026-23024

Indicators of Compromise

• Gradual increase in kernel memory usage over time, particularly after repeated idpf module operations
• Unreclaimable slab memory growth visible in /proc/meminfo
• System logs showing memory pressure warnings without apparent cause
• Unexpected out-of-memory (OOM) killer activity

Detection Strategies

• Monitor kernel slab allocations using slabtop or /proc/slabinfo for unusual growth patterns
• Track module load/unload events via system audit logs to correlate with memory changes
• Implement automated memory baseline comparisons to detect gradual leaks
• Use kernel memory debugging tools like kmemleak to identify unreferenced memory blocks

Monitoring Recommendations

• Enable kernel memory accounting and set up alerting thresholds for abnormal memory consumption
• Log all rmmod operations for the idpf driver and correlate with system memory metrics
• Deploy SentinelOne Singularity platform for real-time kernel-level monitoring and anomaly detection
• Periodically audit flow steering rules to ensure proper cleanup

How to Mitigate CVE-2026-23024

Immediate Actions Required

• Remove all flow steering rules using ethtool before unloading the idpf module
• Update to a patched kernel version that includes the fix
• Monitor system memory usage for signs of existing leaks
• Consider rebooting affected systems to reclaim any leaked memory

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix implements proper cleanup of the flow steering list during module removal and adds spinlock protection for thread-safe list access.

Patch commits are available in the kernel Git repository:

• Kernel Git Commit 1aedff70a5e97628eaaf17b169774cb6a45a1dc5
• Kernel Git Commit f9841bd28b600526ca4f6713b0ca49bf7bb98452

System administrators should apply these patches through their distribution's standard kernel update process or by building a patched kernel from source.

Workarounds

• Ensure all flow steering rules are explicitly deleted via ethtool before unloading the idpf module
• Avoid repeated module unload/reload cycles on production systems until patched
• Implement automated scripts to clean up flow steering rules before module removal
• Schedule regular system reboots to reclaim any leaked memory if patching is not immediately possible

# Remove all flow steering rules before unloading idpf module
# List existing rules
ethtool -n eth0

# Delete rules (replace N with rule ID)
ethtool -N eth0 delete N

# Then safely unload the module
rmmod idpf