CVE-2026-23081: Linux Kernel OF Node Refcount Vulnerability

CVE-2026-23081 Overview

CVE-2026-23081 is a medium severity vulnerability in the Linux kernel's Intel XWAY PHY driver (net/phy/intel-xway). The flaw is an Open Firmware (OF) device tree node reference count leak that occurs when the driver checks for the presence of the leds child node. The driver fails to call of_put_node() to release the obtained node reference, causing the kernel to leak refcounts on every probe path that exercises this code.

Critical Impact
A local low-privileged actor can trigger conditions that exhaust kernel resources, resulting in availability impact on the affected Linux host.

Affected Products

Linux Kernel 6.19-rc1
Linux Kernel 6.19-rc2 through 6.19-rc6
Systems using the intel-xway PHY driver with device tree nodes referencing leds

Discovery Timeline

2026-02-04 - CVE-2026-23081 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23081

Vulnerability Analysis

The vulnerability resides in the Intel XWAY Ethernet PHY driver within the Linux kernel networking subsystem. During driver initialization, the code queries the device tree for an optional leds child node to configure LED indicator behavior on the PHY. The lookup function returns a reference-counted handle to the device tree node, which the kernel uses to manage the lifetime of in-memory device tree representations.

The driver checks whether the leds child node exists but does not decrement the reference count after the check completes. Each invocation increments the OF node refcount without a matching release. Over repeated probe, bind, or unbind cycles, this leak accumulates, leaving kernel data structures pinned in memory and preventing proper teardown of device tree resources.

The issue is classified under [CWE-Other] by NVD and falls into the category of resource management errors specific to kernel reference counting. While not a memory corruption flaw, the leak degrades kernel stability over time and can be weaponized to cause availability impact through resource exhaustion.

Root Cause

The root cause is a missing call to of_node_put() after of_get_child_by_name() (or equivalent lookup) returns a node handle for the leds subnode. OF node lookup helpers increment the kref of the returned node, and callers are required to release the reference once they finish using the pointer. The intel-xway driver omitted this release, breaking the OF subsystem's reference counting contract.

Attack Vector

Exploitation requires local access with low privileges on the affected system. The attack vector is local with low attack complexity and no user interaction required. An attacker capable of triggering repeated driver bind and unbind cycles, or repeated module load and unload operations on a system with the intel-xway PHY present, can amplify the leak to exhaust kernel memory tracking OF nodes. The confidentiality and integrity impacts are none, while availability impact is high.

The vulnerability cannot be triggered remotely and does not yield code execution or information disclosure. No public proof-of-concept exploit is available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-23081

Indicators of Compromise

Unusual growth in kernel slab caches associated with of_node allocations visible via /proc/slabinfo.
Repeated bind and unbind events for intel-xway PHY devices logged in dmesg or systemd journal.
Gradual reduction in available kernel memory on long-running systems hosting Intel XWAY PHY hardware.

Detection Strategies

Inventory kernel versions across Linux fleets and flag hosts running 6.19-rc1 through 6.19-rc6 with the intel-xway driver loaded.
Monitor lsmod and modinfo output to identify systems where the vulnerable driver is active.
Correlate kernel module load events with subsequent memory pressure indicators in telemetry pipelines.

Monitoring Recommendations

Collect kernel memory metrics including slab usage and MemAvailable from /proc/meminfo for trend analysis.
Alert on anomalous module reload patterns that could indicate attempts to amplify the refcount leak.
Track patch deployment status against the upstream commits referenced in the kernel.org advisories.

How to Mitigate CVE-2026-23081

Immediate Actions Required

Apply the upstream kernel patches referenced in commits 1f24dfd556401b75f78e8d9cbd94dd9f31411c3a and 79912b256e14054e6ba177d7e7e631485ce23dbe.
Update affected systems to a Linux kernel release that includes the of_node_put() fix for the intel-xway driver.
Restrict local shell access on systems running affected kernel versions to limit the population of users who can trigger driver lifecycle events.

Patch Information

The fix adds the missing of_put_node() call after the existence check for the leds child node, restoring correct refcount maintenance. Patches are available via the upstream stable tree at the Kernel Git Commit Patch and Kernel Git Commit Update. Distribution vendors will incorporate the fix into stable kernel updates; administrators should subscribe to vendor security advisories for backported releases.

Workarounds

Unload the intel-xway module on systems that do not require Intel XWAY PHY functionality using modprobe -r intel-xway.
Blacklist the driver via /etc/modprobe.d/blacklist.conf where the hardware is not present to prevent accidental load.
Limit module management capabilities by tightening CAP_SYS_MODULE and restricting access to /sys/bus/mdio_bus paths used for driver bind operations.

bash

# Configuration example: prevent loading of the vulnerable driver
echo "blacklist intel-xway" | sudo tee /etc/modprobe.d/cve-2026-23081.conf
sudo update-initramfs -u
# Verify the module is not loaded
lsmod | grep intel_xway