CVE-2026-23176 Overview
CVE-2026-23176 is a memory leak vulnerability in the Linux kernel's toshiba_haps platform driver under platform/x86. The toshiba_haps_add() function leaks the haps object it allocates when the function returns an error after a successful allocation. The toshiba_haps_remove() function also fails to free the object pointed to by toshiba_haps before clearing that pointer, leaving allocated memory unreachable. Both code paths produce orphaned kernel memory allocations on affected systems running the Toshiba Hard Drive Active Protection Sensor driver.
Critical Impact
Repeated probe failures or module load/unload cycles consume kernel memory that cannot be reclaimed, leading to gradual resource exhaustion on affected systems.
Affected Products
- Linux kernel builds containing the toshiba_haps platform/x86 driver
- Toshiba laptops using the Hard Drive Active Protection Sensor (HAPS) interface
- Distributions shipping vulnerable kernel versions prior to the referenced stable patches
Discovery Timeline
- 2026-02-14 - CVE-2026-23176 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-23176
Vulnerability Analysis
The vulnerability resides in the toshiba_haps driver located under drivers/platform/x86/. This driver supports Toshiba's Hard Drive Active Protection Sensor, an ACPI interface used to park hard drive heads when sudden motion is detected. Two functions handle the lifecycle of the driver's primary data structure, and both contain memory management defects classified as [CWE-401] memory leaks.
In toshiba_haps_add(), the driver allocates a haps object during ACPI device initialization. If a later step in the same function returns an error, the function exits without releasing the previously allocated memory. The allocated object becomes unreachable because no pointer to it persists outside the failed initialization path.
In toshiba_haps_remove(), the driver clears the toshiba_haps global pointer without first freeing the underlying object. The memory remains allocated but no longer accessible from any kernel structure, producing a permanent leak for every probe/remove cycle.
Root Cause
The root cause is manual memory management using kzalloc() without consistent paired calls to kfree() across all error and teardown paths. The fix replaces these allocations with devm_kzalloc(), which ties the allocation lifetime to the underlying device. Resource-managed allocation ensures automatic cleanup on probe failure and device removal.
Attack Vector
The vulnerability requires local access to a system running the affected driver. An attacker with the ability to trigger repeated module load/unload cycles or repeated probe failures can incrementally exhaust kernel memory. Exploitation depends on hardware presence of a Toshiba HAPS-compatible ACPI device, which limits the attack surface to specific Toshiba laptop models.
The vulnerability does not enable code execution or privilege escalation directly. It contributes to denial-of-service conditions through resource exhaustion over time. No public proof-of-concept exists, and the EPSS data indicates a low probability of exploitation in the wild.
Detection Methods for CVE-2026-23176
Indicators of Compromise
- Gradual reduction in available kernel slab memory on Toshiba laptops with HAPS hardware
- Repeated probe failures for toshiba_haps visible in dmesg output
- Unaccounted growth in kmalloc-* slab caches reported by /proc/slabinfo
Detection Strategies
- Audit installed kernel versions against the patched commit hashes referenced in the kernel.org stable tree
- Monitor dmesg logs for toshiba_haps driver initialization errors that indicate triggered leak paths
- Compare kernel memory baselines before and after suspected module reload activity
Monitoring Recommendations
- Track kernel memory consumption trends with tools such as slabtop and node-exporter metrics
- Alert on repeated insertion or removal of the toshiba_haps kernel module on production endpoints
- Centralize kernel logs to detect anomalous driver behavior across fleets of Toshiba hardware
How to Mitigate CVE-2026-23176
Immediate Actions Required
- Update affected Linux kernels to versions containing the upstream fix referenced in the stable tree commits
- Inventory Toshiba laptops in the environment and prioritize patching of systems with HAPS hardware
- Restrict unprivileged module load/unload capability where operationally feasible
Patch Information
The fix replaces kzalloc() with devm_kzalloc() so the memory is tracked and released automatically by the device-managed resource subsystem. Stable kernel patches are available at the following references: Kernel Patch 12849745, Kernel Patch 17f37c4c, Kernel Patch 5bce10f0, Kernel Patch bf047435, Kernel Patch ca9ff71c, Kernel Patch f2093e87, and Kernel Patch f93ae437.
Workarounds
- Blacklist the toshiba_haps kernel module on systems where the Hard Drive Active Protection Sensor is not required
- Avoid manual module unload/reload cycles on unpatched systems to limit cumulative memory leakage
- Schedule reboots on affected systems to reclaim leaked kernel memory until patches are deployed
# Blacklist the toshiba_haps module until patched kernel is deployed
echo "blacklist toshiba_haps" | sudo tee /etc/modprobe.d/blacklist-toshiba-haps.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
