PT-2026-27722 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-05-26 · CVE-2026-23357

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s mcp251x open() function related to a potential deadlock situation. Specifically, the function calls free irq() while holding the mpc lock mutex. If an interrupt occurs during this process, the interrupt handler may wait for the mpc lock, leading to a deadlock. This issue is similar to a previously resolved deadlock but occurs in the error path of the function. The resolution involves moving the free irq() call after releasing the lock and setting priv->force quit = 1 to ensure the interrupt handler exits promptly upon acquiring the lock.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2026-23357

ECHO-4628-5A89-95B3

OPENSUSE-SU-2026:20826-1

SUSE-SU-2026:21841-1

SUSE-SU-2026:21845-1

SUSE-SU-2026:21860-1

SUSE-SU-2026:21876-1

SUSE-SU-2026:21877-1

SUSE-SU-2026:21916-1

SUSE-SU-2026:21919-1

SUSE-SU-2026:2217-1

SUSE-SU-2026:2238-1

Affected Products

Linux Kernel

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23357.json · Exploit
• https://cve.org/CVERecord?id=CVE-2026-23357 · Security Note
• https://git.kernel.org/stable/c/b73832292cd914e87a55e863ba4413a907e7db6b · Patch
• https://git.kernel.org/stable/c/38063cc435b69d56e76f947c10d336fcb2953508 · Patch
• https://osv.dev/vulnerability/CVE-2026-23357 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23357 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23357 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23357 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-23357 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23357 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23357 · Vendor Advisory
• https://git.kernel.org/stable/c/d27f12c3f5e85efc479896af4a69eccb37f75e8e · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23357 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-23357 · Vendor Advisory
• https://git.kernel.org/stable/c/e728f444c913a91d290d1824b4770780bbd6378e · Patch