CVE-2026-23160: Linux Kernel Privilege Escalation Flaw

CVE-2026-23160 Overview

CVE-2026-23160 is a memory leak vulnerability [CWE-401] in the Linux kernel's octeon_ep network driver. The flaw resides in the octep_device_setup() function, where a failed call to octep_ctrl_net_init() causes the function to return without unmapping previously mapped resources or freeing allocated configuration memory. Repeated failures can exhaust kernel memory and degrade system availability. The issue affects multiple Linux 6.19 release candidates and earlier stable branches. The vulnerability was identified through prototype static analysis and code review, and a fix has been merged into upstream stable trees.

Critical Impact
Local low-privileged actors can trigger repeated driver setup failures to leak kernel memory, leading to resource exhaustion and denial of service on affected hosts.

Affected Products

Linux kernel 6.19-rc1 through 6.19-rc7
Earlier stable Linux kernel branches containing the octeon_ep driver
Systems using Marvell Octeon PCIe endpoint NIC hardware

Discovery Timeline

2026-02-14 - CVE-2026-23160 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23160

Vulnerability Analysis

The vulnerability exists in the octep_device_setup() function within the octeon_ep Ethernet driver for Marvell Octeon PCIe endpoint devices. During device initialization, the function maps PCI BAR regions and allocates configuration memory for the device. It then calls octep_ctrl_net_init() to initialize the control network interface.

When octep_ctrl_net_init() returns an error, the original code path returns directly to the caller. This early return skips the cleanup logic at the unsupported_dev label, which unmaps the PCI resources and frees the allocated configuration buffers. Each failed initialization attempt leaks the mapped IO regions and the configuration memory, classified as a missing release of memory after effective lifetime [CWE-401].

Root Cause

The root cause is inconsistent error handling within octep_device_setup(). Other failure paths in the same function correctly use a goto unsupported_dev pattern to release resources, but the octep_ctrl_net_init() failure path was implemented with a bare return statement. The fix replaces the direct return with a jump to the unsupported_dev cleanup label, aligning the failure path with the rest of the function.

Attack Vector

Exploitation requires local access with low privileges. An attacker capable of triggering repeated driver probe or reinitialization events on a system with octeon_ep hardware can amplify the leak. The vulnerability does not affect confidentiality or integrity, but sustained leakage degrades availability by exhausting kernel memory. No code execution primitive is provided by this flaw.

The vulnerability mechanism is described in prose only because no verified proof-of-concept code is available. See the upstream commits in Kernel Git Commit 5058d3f and Kernel Git Commit fdfd28e for the exact code change.

Detection Methods for CVE-2026-23160

Indicators of Compromise

Repeated kernel log entries from the octeon_ep driver reporting failed control network initialization
Steady decline in available kernel slab memory without a corresponding workload increase
Growing vmalloc or PCI resource mapping counts attributable to the octeon_ep driver

Detection Strategies

Monitor dmesg and journald for octep_ctrl_net_init failure messages followed by driver re-probe events
Track kernel memory usage trends with /proc/meminfo, /proc/slabinfo, and /proc/iomem to identify unbounded growth
Compare installed kernel versions against the patched commits listed in the upstream advisory URLs

Monitoring Recommendations

Alert on PCI device re-probe loops or repeated module load/unload cycles for octeon_ep
Baseline normal slab and vmalloc usage on hosts equipped with Marvell Octeon PCIe endpoints
Forward kernel logs to a centralized analytics platform to correlate driver errors across the fleet

How to Mitigate CVE-2026-23160

Immediate Actions Required

Apply the upstream stable kernel update containing the patch for octep_device_setup() on all affected hosts
Inventory systems using Marvell Octeon PCIe endpoint NICs and prioritize them for patching
Restrict local low-privilege access on affected systems until patches are deployed

Patch Information

The fix replaces the direct return after octep_ctrl_net_init() failure with a goto unsupported_dev to perform the required iounmap and configuration memory release. Patched commits are available at Kernel Git Commit 5058d3f, Kernel Git Commit 8016dc5, Kernel Git Commit d753f3c, and Kernel Git Commit fdfd28e. Consume the fix through your distribution's stable kernel update channel.

Workarounds

Blacklist the octeon_ep module on systems that do not require Marvell Octeon PCIe endpoint functionality
Limit user permissions to prevent triggering repeated driver initialization attempts
Reboot affected hosts periodically to reclaim leaked memory until the patched kernel is installed

bash

# Blacklist the octeon_ep module until the patched kernel is deployed
echo "blacklist octeon_ep" | sudo tee /etc/modprobe.d/blacklist-octeon_ep.conf
sudo update-initramfs -u