CVE-2026-23182: Linux Kernel Memory Leak Vulnerability

CVE-2026-23182 Overview

CVE-2026-23182 is a memory leak vulnerability in the Linux kernel's Tegra SLINK Serial Peripheral Interface (SPI) driver. The flaw resides in the tegra_slink_probe() function within the spi-tegra-slink driver. When platform_get_irq() fails during device probing, the function returns an error code directly without releasing previously allocated resources. The upstream fix replaces the direct return with a goto label that routes execution through the proper cleanup path.

Critical Impact
Repeated probe failures on systems using NVIDIA Tegra SoCs with the SLINK SPI controller can exhaust kernel memory over time, leading to degraded performance or denial of service conditions.

Affected Products

Linux kernel versions containing the spi-tegra-slink driver prior to the patched commits
NVIDIA Tegra-based platforms using the SLINK SPI controller
Downstream distributions shipping the affected kernel versions

Discovery Timeline

2026-02-14 - CVE-2026-23182 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-23182

Vulnerability Analysis

The vulnerability is a memory leak [CWE-401] in the probe routine of the Tegra SLINK SPI driver. During device initialization, tegra_slink_probe() allocates kernel resources including the SPI master structure and associated driver data. The function then calls platform_get_irq() to retrieve the interrupt resource for the controller.

When platform_get_irq() fails, the original code path returns the error value directly from the function. This early return bypasses the resource release logic that would normally execute on the failure path. The previously allocated SPI master and driver context remain referenced but unreachable after the probe returns.

Repeated probe attempts, deferred probing, or module load and unload cycles compound the leaked allocations. On long-running systems and embedded Tegra devices with constrained memory, the cumulative leak can reduce available kernel memory and contribute to system instability.

Root Cause

The root cause is improper error path handling in tegra_slink_probe(). The function did not use a centralized cleanup label to release acquired resources before returning. When platform_get_irq() returned an error, control bypassed the unwind logic that would normally execute through goto cleanup targets.

Attack Vector

The defect is triggered by failures in interrupt resource acquisition during driver probe. This typically requires local conditions such as misconfigured device tree entries, hardware errors, or probe deferral scenarios. The issue does not present a direct remote attack vector. Exploitation as a denial-of-service requires the ability to influence probe outcomes on the affected platform.

The upstream patches resolve the issue by routing the platform_get_irq() failure through the existing cleanup goto label, ensuring that spi_master_put() and related teardown calls execute before the function returns. See the kernel patches referenced below for the exact changes:

Detection Methods for CVE-2026-23182

Indicators of Compromise

Kernel log entries from spi-tegra-slink indicating platform_get_irq failures during boot or device probe
Gradual increase in kernel slab allocations attributable to SPI master objects without corresponding releases
Repeated probe deferrals or module reload events involving the Tegra SLINK driver

Detection Strategies

Audit the running kernel version against the patched commits listed in the kernel.org references
Inspect dmesg output and persistent journal logs for tegra-slink probe errors correlated with rising memory usage
Use slabtop and /proc/slabinfo to baseline SPI-related allocations on Tegra platforms

Monitoring Recommendations

Track kernel memory consumption trends on Tegra-based embedded fleets and alert on sustained growth in unreclaimable slab
Centralize kernel logs and create rules that flag repeated SPI controller probe failures
Verify package and kernel inventory against distribution security advisories that reference CVE-2026-23182

How to Mitigate CVE-2026-23182

Immediate Actions Required

Identify all hosts and embedded devices running Linux kernels that include the unpatched spi-tegra-slink driver
Apply the stable kernel update that contains one of the referenced fix commits
Reboot affected systems after patching to load the corrected driver

Patch Information

The fix is available in upstream Linux stable trees through commits 075415ae, 126a09f4, 327b7132, 41d9a679, 6a04dc65, and b8eec12a. Each commit modifies tegra_slink_probe() to use a goto cleanup label on the platform_get_irq() error path. Operators should consume the fix through their distribution's kernel security update channel or rebuild from a patched stable tag.

Workarounds

If patching is not immediately possible, disable the spi-tegra-slink driver on systems where the SLINK SPI controller is not required
Schedule periodic reboots on long-running Tegra devices to reclaim leaked kernel memory until the patched kernel is deployed
Validate device tree configurations to reduce probe failures that trigger the leaking error path

bash

# Verify the running kernel and check for the patched commit in changelogs
uname -r

# On systems using modules, blacklist the affected driver as a temporary measure
echo "blacklist spi_tegra_slink" | sudo tee /etc/modprobe.d/blacklist-tegra-slink.conf
sudo update-initramfs -u