PT-2026-5531 · Kvm+1 · Kvm+1

Published 2026-01-01 · Updated 2026-04-20 · CVE-2026-23028

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:A/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a memory leak within the KVM (Kernel-based Virtual Machine) component on LoongArch architecture. Specifically, the kvm device structure is not properly freed in the kvm ipi destroy() function after being allocated in kvm ioctl create device(). This results in a memory leak. The vulnerable function is kvm ipi destroy().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2026-03765

CVE-2026-23028

ECHO-B836-A6CD-E4E7

Affected Products

Kvm

Linux Kernel

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23028.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23028 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23028 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-23028 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23028 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23028 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-23028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23028 · Security Note
• https://bdu.fstec.ru/vul/2026-03765 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23028 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23028 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://git.kernel.org/stable/c/0bf58cb7288a4d3de6d8ecbb3a65928a9362bf21 · Note
• https://t.me/CVEtracker/43388 · Telegram Post
• https://git.kernel.org/linus/0bf58cb7288a4d3de6d8ecbb3a65928a9362bf21 · Note