CVE-2026-23065: Linux Kernel Memory Leak Vulnerability

CVE-2026-23065 Overview

CVE-2026-23065 is a memory leak vulnerability in the Linux kernel's AMD platform driver, specifically in the wbrf_record() function within platform/x86/amd. The flaw stems from improper error handling where a temporary buffer allocated via kcalloc() is not freed when acpi_evaluate_dsm() fails. Repeatedly triggering this error path causes kernel memory exhaustion over time. The vulnerability is tracked under [CWE-401] (Missing Release of Memory after Effective Lifetime) and affects Linux kernel 6.19 release candidates.

Critical Impact
A local authenticated user can trigger repeated failures in the AMD Wifi Band RFI Mitigation (WBRF) ACPI path, causing kernel memory exhaustion and potential denial of service on affected systems.

Affected Products

Linux Kernel 6.19-rc1 through 6.19-rc6
Systems using the platform/x86/amd driver with WBRF support
AMD platforms invoking acpi_evaluate_dsm() through the WBRF interface

Discovery Timeline

2026-02-04 - CVE-2026-23065 published to NVD
2026-03-13 - Last updated in NVD database

Technical Details for CVE-2026-23065

Vulnerability Analysis

The vulnerability resides in the wbrf_record() function of the AMD platform driver, which handles Wifi Band RFI Mitigation (WBRF) operations via ACPI Device Specific Methods (DSM). The function allocates a temporary buffer using kcalloc() to prepare data for ACPI evaluation. When acpi_evaluate_dsm() returns an error, the function exits without releasing the allocated buffer.

Each failed invocation leaks a kernel heap allocation. Sustained invocation degrades system stability and can lead to out-of-memory conditions affecting other kernel subsystems. The leaked memory persists until system reboot because kernel allocations are not garbage collected.

Root Cause

The root cause is a missing kfree() call in the error handling path following an acpi_evaluate_dsm() failure. The original code did not propagate cleanup logic to all return paths, leaving the tmp buffer orphaned on the kernel heap when ACPI evaluation failed.

Attack Vector

Exploitation requires local access with low privileges. An attacker repeatedly invokes the code path that triggers wbrf_record() and arranges for acpi_evaluate_dsm() to fail, draining kernel memory. The attack does not require user interaction and impacts system availability. Confidentiality and integrity are not directly affected.

No public proof-of-concept exploit exists for this vulnerability. The fix adds an explicit kfree(tmp) in the error handling path of acpi_evaluate_dsm(). Refer to the Kernel Git Change Log for the upstream patch details.

Detection Methods for CVE-2026-23065

Indicators of Compromise

Gradual decrease in available kernel slab memory over uptime without corresponding workload increase
Growing kmalloc-* slab cache sizes visible in /proc/slabinfo on AMD systems
Repeated ACPI DSM evaluation failures logged in dmesg related to the WBRF subsystem
Out-of-memory killer activity on long-running AMD platforms with WBRF enabled

Detection Strategies

Monitor kernel version strings against the affected 6.19-rc1 through 6.19-rc6 release candidates
Track slab allocator metrics through /proc/meminfo and /proc/slabinfo for unexplained growth
Enable kmemleak on test systems to identify outstanding kernel allocations tied to wbrf_record()
Audit kernel build configurations for CONFIG_AMD_WBRF on systems running release candidate kernels

Monitoring Recommendations

Establish baselines for kernel slab usage on AMD endpoints and alert on sustained drift
Forward kernel logs to a centralized logging platform and flag repeated ACPI DSM errors
Track host availability metrics and OOM events across fleets running Linux 6.19 prerelease builds
Inventory systems running release candidate kernels in production environments

How to Mitigate CVE-2026-23065

Immediate Actions Required

Upgrade affected systems to a Linux kernel build containing the upstream fix from the stable tree
Avoid running Linux 6.19 release candidate kernels in production until a stable 6.19 release includes the patch
Restrict local shell access on multi-tenant systems where unprivileged users could trigger the code path
Identify AMD platforms with WBRF enabled and prioritize them for kernel updates

Patch Information

The fix is committed upstream in the stable kernel tree. Apply the patches referenced in the Kernel Git Change Log commit 2bf1877b, commit 1a0072bd, and commit 1152dffe. The patch explicitly calls kfree(tmp) in the error handling path of acpi_evaluate_dsm().

Workarounds

Disable the CONFIG_AMD_WBRF kernel option and rebuild the kernel where WBRF functionality is not required
Unload or blacklist the AMD platform module on systems that do not depend on WBRF features
Limit local user access via standard access controls until the patched kernel is deployed

bash

# Verify running kernel version and check for affected release candidate
uname -r

# Inspect slab allocator for memory growth indicators
cat /proc/slabinfo | grep kmalloc

# Check dmesg for ACPI DSM evaluation failures
dmesg | grep -iE 'acpi.*dsm|wbrf'