CVE-2026-23024: Linux Kernel Memory Leak Vulnerability

CVE-2026-23024 Overview

CVE-2026-23024 is a memory leak vulnerability in the Linux kernel's idpf (Infrastructure Data Path Function) network driver. The flaw exists in the flow steering list cleanup logic, which fails to free entries during module removal (rmmod). When ethtool adds flow steering rules and the module is unloaded with active entries, the associated memory is not released. The vulnerability is tracked under [CWE-401: Missing Release of Memory after Effective Lifetime]. Local attackers with low privileges can trigger this condition to exhaust kernel memory, leading to denial of service on affected systems.

Critical Impact
Repeated load and unload of the idpf driver with active flow steering rules causes cumulative kernel memory exhaustion, resulting in system instability or denial of service.

Affected Products

Linux Kernel version 6.17
Linux Kernel 6.19 release candidates (rc1 through rc8)
Systems using the Intel idpf network driver with flow steering configured via ethtool

Discovery Timeline

2026-01-31 - CVE-2026-23024 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23024

Vulnerability Analysis

The idpf driver maintains a flow steering list that tracks rules added through the ethtool interface. Each entry represents a packet classification rule that directs matching traffic to specific receive queues. The driver dynamically allocates memory for these entries when rules are created and is expected to release that memory when rules are deleted or when the driver is unloaded.

The vulnerability stems from incomplete cleanup logic in the module removal path. When administrators execute rmmod idpf while flow steering entries remain active, the driver tears down hardware state but does not iterate the flow steering list to free outstanding allocations. The orphaned memory remains allocated in kernel space until system reboot.

The upstream patches resolve the issue by walking the remaining entries during teardown and freeing the associated memory. A new spinlock named flow_steer_list_lock was added to protect concurrent list access from multiple threads, addressing a related race condition in list manipulation.

Root Cause

The root cause is missing cleanup of dynamically allocated list entries in the driver's module exit path. The original implementation assumed flow steering rules would be removed individually through ethtool before module unload. This assumption does not hold in operational environments where administrators unload drivers without explicitly clearing rules.

Attack Vector

Exploitation requires local access with privileges sufficient to load and unload kernel modules, typically CAP_SYS_MODULE. An attacker who can repeatedly add flow steering rules and reload the driver can incrementally consume kernel memory. The vulnerability does not allow remote exploitation, code execution, or information disclosure. Impact is limited to availability.

The vulnerability mechanism is described in the upstream commits. See the Kernel Git Commit Change (1aedff70) and the Kernel Git Commit Change (f9841bd2) for the full patch details.

Detection Methods for CVE-2026-23024

Indicators of Compromise

Unexplained growth in kernel slab memory usage visible in /proc/slabinfo after repeated idpf module reloads
Increasing kmalloc-* allocations correlated with ethtool flow steering rule additions on affected kernels
Kernel memory pressure events or out-of-memory conditions on systems with frequent driver reload cycles

Detection Strategies

Compare installed kernel version against the affected ranges (6.17 and 6.19-rc1 through 6.19-rc8) using uname -r
Monitor ethtool -n <iface> output to enumerate active flow steering rules before driver unload
Audit system logs for rmmod idpf events on hosts using Intel IPU or compatible hardware

Monitoring Recommendations

Collect kernel memory metrics via node_exporter or equivalent and alert on sustained growth in slab caches
Forward auditd records for init_module and delete_module syscalls to a centralized SIEM for correlation
Track ethtool rule lifecycle events to identify hosts with active flow steering configurations

How to Mitigate CVE-2026-23024

Immediate Actions Required

Apply the upstream kernel patches referenced in the vendor advisories on all systems running affected idpf driver versions
Restrict CAP_SYS_MODULE and root privileges to authorized administrators only
Avoid unloading the idpf driver while flow steering rules remain active until patches are deployed

Patch Information

The fix is available in upstream Linux kernel commits 1aedff70a5e9 and f9841bd28b60. Both commits introduce the cleanup loop in the module exit path and add the flow_steer_list_lock spinlock to serialize list operations. Distribution maintainers should backport these commits to supported stable kernel branches. Verify your distribution's security tracker for backported package availability.

Workarounds

Remove all flow steering rules with ethtool -N <iface> delete <rule-id> before unloading the idpf module
Disable flow steering functionality on interfaces where it is not required for operational use
Limit module unload operations to scheduled maintenance windows on unpatched systems

bash

# Clear flow steering rules before unloading the idpf driver
for rule in $(ethtool -n eth0 | awk '/Filter:/ {print $2}'); do
    ethtool -N eth0 delete $rule
done
rmmod idpf