CVE-2026-23137: Linux Kernel Memory Leak Vulnerability

CVE-2026-23137 Overview

A memory leak vulnerability has been identified in the Linux kernel's Device Tree (OF) unittest subsystem. The vulnerability exists in the unittest_data_add() function, where allocated unittest_data memory is not properly freed when of_resolve_phandles() fails, leading to a memory leak condition.

Critical Impact

Repeated triggering of this memory leak during kernel unit testing could lead to gradual memory exhaustion, potentially impacting system stability and performance.

Affected Products

• Linux Kernel (affected versions prior to the fix)

Discovery Timeline

• February 14, 2026 - CVE-2026-23137 published to NVD
• February 18, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23137

Vulnerability Analysis

This memory leak vulnerability occurs within the Linux kernel's Open Firmware (OF) unittest infrastructure. The unittest_data_add() function is responsible for allocating and managing test data structures used during device tree unit testing. When the function calls of_resolve_phandles() to resolve device tree phandle references, and that operation fails, the previously allocated unittest_data structure is not released back to the kernel memory allocator.

The vulnerability represents a resource management flaw in the error handling path. While memory leaks in kernel space may seem less critical than other vulnerability types, they can accumulate over time, especially in automated testing environments or systems running continuous integration workloads that exercise the unittest functionality repeatedly.

Root Cause

The root cause is improper error handling in unittest_data_add(). When of_resolve_phandles() returns an error, the code path exits without calling kfree() on the allocated unittest_data structure. This is a classic resource leak pattern where memory is allocated but ownership is not properly transferred or released in all execution paths.

The fix introduces scope-based cleanup using the __free(kfree) helper macro, which ensures automatic resource cleanup when variables go out of scope. For the success path, retain_and_null_ptr() is used to transfer memory ownership to the device tree subsystem, preventing double-free conditions.

Attack Vector

The attack vector for this vulnerability is local in nature. An attacker would need the ability to trigger the unittest code path, which typically requires either:

1. Access to kernel module loading capabilities to load the OF unittest module
2. A kernel configuration that includes OF unittests enabled at boot time
3. Access to kernel debugging interfaces that can invoke unittest functionality

In practical terms, exploitation would involve repeatedly triggering the failing code path to gradually exhaust available kernel memory. The vulnerability's exploitability is limited by the requirement for local access and the ability to invoke kernel unittest functionality.

Detection Methods for CVE-2026-23137

Indicators of Compromise

• Gradual increase in kernel memory consumption over time, particularly in kmalloc allocations
• Kernel log messages indicating of_resolve_phandles() failures during unittest operations
• Memory pressure warnings in systems running device tree unit tests

Detection Strategies

• Monitor kernel memory allocations using tools like kmemleak to identify unreleased unittest_data structures
• Review kernel logs for OF unittest error messages that may indicate repeated triggering of the vulnerable code path
• Use memory profiling tools to track allocation patterns in the OF subsystem

Monitoring Recommendations

• Enable kernel memory leak detection (CONFIG_DEBUG_KMEMLEAK) in development and testing environments
• Implement memory consumption monitoring and alerting for systems running kernel unit tests
• Review slab allocator statistics for unusual growth patterns in relevant caches

How to Mitigate CVE-2026-23137

Immediate Actions Required

• Update to a patched Linux kernel version that includes the fix
• If updating is not immediately possible, avoid running OF unittest code on production systems
• Disable OF unittest module if it is not required for system operation

Patch Information

The vulnerability has been addressed in the Linux kernel through commits that implement proper scope-based resource cleanup. The fix uses the __free(kfree) macro for automatic memory management and retain_and_null_ptr() for safe ownership transfer.

Patch references:

• Kernel Git Commit 235a1eb8d2dc
• Kernel Git Commit f09b0f705bd7

Workarounds

• Disable the OF unittest module by setting CONFIG_OF_UNITTEST=n in kernel configuration if the unittest functionality is not required
• Limit access to kernel module loading and debugging interfaces to trusted users only
• Monitor memory usage and restart affected services or systems if memory exhaustion is observed