PT-2026-4675 · Octeon Ep+1 · Octeon Ep+1

Published 2026-01-01 · Updated 2026-03-13 · CVE-2026-23013

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the Octeon EP Virtual Function (VF) network driver related to Interrupt Request (IRQ) handling. Specifically, a mismatch in the dev id used during free irq() calls within the IRQ rollback loop can occur if request irq() fails during IRQ registration. This mismatch can lead to IRQ handlers remaining active even after the associated memory is freed, potentially resulting in a use-after-free condition or system crash when an interrupt fires. The issue arises because octep vf request irqs() requests MSI-X queue IRQs with a dev id set to ioq vector, but the rollback loop uses dev id set to 'oct' when calling free irq(). The fix ensures that IRQs are freed using the original ioq vector dev id.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-04125

CVE-2026-23013

Affected Products

Linux Kernel

Octeon Ep

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23013.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23013 · Security Note
• https://ubuntu.com/security/CVE-2026-23013 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04125 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23013 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23013 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-23013 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-23013 · Vendor Advisory
• https://git.kernel.org/stable/c/aa4c066229b05fc3d3c5f42693d25b1828533b6e · Patch
• https://git.kernel.org/stable/c/aa05a8371ae4a452df623f7202c72409d3c50e40 · Patch
• https://git.kernel.org/stable/c/f93fc5d12d69012788f82151bee55fce937e1432 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-23013 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23013 · Vendor Advisory
• https://git.kernel.org/linus/f93fc5d12d69012788f82151bee55fce937e1432 · Note