CVE-2026-23260: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23260 Overview

CVE-2026-23260 is a memory leak vulnerability in the Linux kernel's regmap maple tree implementation. The vulnerability exists in the regcache_maple_write() function, which allocates a new block ('entry') to merge adjacent ranges and stores it using mas_store_gfp(). When mas_store_gfp() fails, the newly allocated 'entry' remains allocated and is never freed, resulting in a memory leak condition.

Critical Impact

Memory leak in the Linux kernel's regmap subsystem can lead to resource exhaustion and potential denial of service conditions on affected systems.

Affected Products

• Linux Kernel (affected versions prior to patch)

Discovery Timeline

• 2026-03-18 - CVE CVE-2026-23260 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-23260

Vulnerability Analysis

This vulnerability is classified as a Memory Leak within the Linux kernel's regmap maple tree caching subsystem. The regcache_maple subsystem is responsible for efficiently caching register values using a maple tree data structure, which provides optimized storage and retrieval operations.

The vulnerability occurs in the regcache_maple_write() function during the process of merging adjacent register ranges. When the function allocates a new entry block intended to consolidate neighboring ranges, it subsequently attempts to store this entry using mas_store_gfp(). The critical flaw emerges when this storage operation fails—the error handling path does not properly deallocate the previously allocated entry block.

Under normal operation, successful completion of mas_store_gfp() would lead to the proper cleanup of replaced neighbor blocks (referred to as 'lower' and 'upper' in the codebase). However, the failure path neglects to free the 'entry' allocation, causing memory to accumulate over time.

Root Cause

The root cause is improper error handling in the regcache_maple_write() function. When mas_store_gfp() fails to store the newly allocated entry into the maple tree, the code does not include logic to free the 'entry' allocation before returning from the function. This creates a classic memory leak scenario where allocated kernel memory becomes unreachable and cannot be reclaimed.

Attack Vector

The attack vector for this vulnerability is not fully characterized in the available data. The memory leak requires triggering conditions that cause mas_store_gfp() to fail during regcache maple write operations. While not immediately exploitable for code execution, sustained triggering of this condition could lead to kernel memory exhaustion, potentially causing system instability or denial of service. The practical exploitation depends on the ability to repeatedly trigger the vulnerable code path and cause allocation failures.

Detection Methods for CVE-2026-23260

Indicators of Compromise

• Gradual increase in kernel memory usage without corresponding user-space activity
• System logs showing memory allocation warnings or failures in the regmap subsystem
• Unexplained system performance degradation over time

Detection Strategies

• Monitor kernel memory allocation patterns using tools such as /proc/meminfo and slabtop
• Enable kernel memory debugging features such as KASAN (Kernel Address Sanitizer) to detect memory leaks
• Analyze kernel logs for regmap or maple tree related errors

Monitoring Recommendations

• Implement continuous monitoring of kernel memory consumption metrics
• Set up alerts for abnormal memory growth patterns in production systems
• Review system stability logs for regmap-related warnings or errors

How to Mitigate CVE-2026-23260

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the fix for this vulnerability
• Monitor affected systems for signs of memory exhaustion
• Consider scheduling system reboots for systems that cannot be immediately patched to clear accumulated leaked memory

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix ensures that the 'entry' allocation is properly freed on the failure path when mas_store_gfp() fails. Multiple stable kernel branches have received this fix:

• Linux Kernel Commit 811b45e2
• Linux Kernel Commit d61171cf
• Linux Kernel Commit f08f2d29
• Linux Kernel Commit f3f380ce

Workarounds

• Implement periodic system reboots to recover leaked memory if immediate patching is not feasible
• Monitor memory usage closely and restart affected services or the system when memory consumption reaches critical thresholds
• Consider reducing workloads that heavily utilize the regmap subsystem until patches can be applied

# Check current kernel version and verify if patched
uname -r
# Monitor kernel memory usage
cat /proc/meminfo | grep -E "MemTotal|MemFree|Slab"
# View slab allocation statistics for potential leak detection
sudo slabtop -o