CVE-2026-23090: Linux Kernel Device Reference Leak Bug

CVE-2026-23090 Overview

CVE-2026-23090 is a device reference leak in the Linux kernel's Slimbus (Serial Low-power Inter-chip Media Bus) core subsystem. The flaw resides in the slimbus/core driver code path that processes report-present messages from Slimbus peripherals. When the driver looks up an already-registered device, it fails to release the reference taken during lookup, producing a steady reference count leak on each report-present event. Over time, the leak can prevent device teardown and exhaust kernel resources, leading to denial-of-service conditions on systems that rely on the Slimbus subsystem (commonly Qualcomm-based platforms for audio peripherals).

Critical Impact
A local low-privileged actor able to trigger repeated Slimbus report-present events can exhaust kernel resources and cause a high-availability impact on affected systems.

Affected Products

Linux kernel mainline development branches affected through 6.19-rc6
Linux kernel 6.19 release candidates rc1 through rc6
Stable kernel branches prior to the fixes referenced in the upstream commits

Discovery Timeline

2026-02-04 - CVE-2026-23090 published to NVD
2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-23090

Vulnerability Analysis

The Slimbus core subsystem dynamically allocates device structures when it receives report-present messages from peripherals announcing their presence on the bus. The driver consults a registry to determine whether the announcing device already has an in-kernel representation. The lookup routine acquires a reference on any matching device but the caller in the report-present handler does not balance that acquisition with a corresponding put once it finishes using the device. Each report-present message therefore increments the device's reference count without decrement. The fix also requires taking an extra reference when the device has not yet been registered and must be allocated, keeping the reference accounting symmetric across both code paths. The vulnerability is classified under NVD-CWE-Other and primarily impacts availability.

Root Cause

The defect is an unbalanced kobject reference acquisition in the Slimbus core. The lookup helper returns an already-referenced device pointer, but the report-present handler treats the return value as if no reference were held. The result is a slow leak of struct device objects and any resources transitively pinned by them, including driver-private state and DMA mappings.

Attack Vector

Exploitation requires local access with the ability to interact with the Slimbus subsystem, either through a userspace driver interface or by inducing the controller to emit repeated report-present events. The flaw does not yield code execution or information disclosure. Sustained triggering of the leak degrades the system through memory pressure and may prevent clean device removal or controller reset.

No verified exploit code is available. Refer to the upstream commits for the precise call sites and reference-counting semantics.

Detection Methods for CVE-2026-23090

Indicators of Compromise

Steadily increasing kmemleak or slab allocations associated with slim_device objects on systems that handle Slimbus traffic
Failure of Slimbus controllers to unbind, suspend, or reset after extended runtime
Kernel log entries showing repeated report-present events without matching device-release callbacks

Detection Strategies

Compare the running kernel version against the fixed commits listed in the kernel.org stable tree and flag any build at or before 6.19-rc6 lacking the patch
Enable CONFIG_DEBUG_KOBJECT_RELEASE and CONFIG_KMEMLEAK in test environments to surface unreleased Slimbus device references
Monitor available kernel memory and slab_unreclaimable counters on platforms with active Slimbus peripherals

Monitoring Recommendations

Collect /proc/slabinfo deltas over time and alert on growth in slim_device-related caches
Forward dmesg and audit logs to a central log store and search for repeated Slimbus enumeration events on the same endpoint address
Track host uptime and free memory trends on Qualcomm-based platforms where Slimbus is in use

How to Mitigate CVE-2026-23090

Immediate Actions Required

Inventory Linux hosts and embedded devices running kernel 6.19-rc1 through 6.19-rc6 or unpatched stable branches
Apply the upstream fix from the Linux stable tree or pull the corresponding distribution update
Restrict local access to systems that expose Slimbus userspace interfaces until patched

Patch Information

The issue is resolved across multiple stable branches by the upstream commits referenced in the NVD entry. See Kernel Commit 02b78bbf, Kernel Commit 2ddc09f6, Kernel Commit 54de72a7, Kernel Commit 6602bb4d, Kernel Commit 9391380e, Kernel Commit 94861542, and Kernel Commit b1217e40. Rebuild any custom kernels with these commits backported.

Workarounds

Disable the Slimbus subsystem in kernel configuration (CONFIG_SLIMBUS=n) on systems that do not require it
Unload the Slimbus controller module when not in active use to break the leak path
Reboot affected systems periodically until a patched kernel is deployed to reclaim leaked references

bash

# Verify whether the running kernel includes a Slimbus core fix commit
uname -r
zgrep -i 'slimbus' /proc/config.gz 2>/dev/null || grep -i 'slimbus' /boot/config-$(uname -r)

# Disable Slimbus at runtime if the module is loaded and not required
sudo modprobe -r slimbus