PT-2026-30148 · Linux · Linux Kernel

Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-23453

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak exists in the Linux kernel's ICSSG-PRUETH driver when handling XDP DROP packets in non-zero-copy mode. The removal of page recycling from the XDP DROP path in the emac run xdp() function, intended to avoid conflicts with AF XDP zero-copy mode, resulted in pages not being returned to the page pool. This leads to a memory leak and potential out-of-memory (OOM) conditions. The fix involves handling cleanup in the emac rx packet() function, recycling the page back to the page pool when emac run xdp() returns ICSSG XDP CONSUMED for XDP DROP.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-23453

Affected Products

Linux Kernel

References · 10

• https://ubuntu.com/security/CVE-2026-23453 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23453 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23453 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23453 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23453 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23453 · Vendor Advisory
• https://twitter.com/CVEnew/status/2040111876504490083 · Twitter Post
• https://git.kernel.org/stable/c/719d3e71691db7c4f1658ba5a6d1472928121594 · Note
• https://git.kernel.org/linus/719d3e71691db7c4f1658ba5a6d1472928121594 · Note
• https://git.kernel.org/stable/c/d16d57dedcb69c1a1257e0638f8698ce1f0ccbe5 · Note