Security readout for executives and security teams
Plain-English summary
A Linux network driver can leave an interrupt handler active after a partial setup failure. Later cleanup may free memory still referenced by that handler, potentially causing a kernel crash or use-after-free when an interrupt occurs. Risk is concentrated in systems using the octeon_ep_vf driver, not Linux systems generally.
Executive priority
Prioritize remediation on systems actively using octeon_ep_vf, especially critical network infrastructure where kernel crashes would disrupt service. Treat other Linux systems as lower priority after confirming the driver is absent. Evidence supports a serious local flaw, but not active exploitation or broad remote exposure.
Technical view
octep_vf_request_irqs() registers MSI-X queue interrupts using ioq_vector as dev_id. Its rollback path incorrectly passed oct to free_irq(), so the irqaction could remain registered. Subsequent teardown may free ioq_vector, creating a use-after-free when the retained handler runs. The published correction uses the matching ioq_vector identifier during rollback.
Likely exposure
Exposure requires an affected Linux kernel, use of the octeon_ep_vf network driver, and a partial IRQ-registration failure that reaches the faulty rollback path. The bundle marks Linux versions including 6.9, 6.12.67, 6.18.7, and 6.19 as affected, but exact distribution package status is not provided.
Exploitation context
The supplied CVSS 3.1 score is 7.0: local access, high complexity, low privileges, and no user interaction. CISA KEV status is false, and the provided sources do not report active exploitation or a public exploit. Confidentiality, integrity, and availability impacts are rated high, although the description specifically demonstrates use-after-free or crash potential.
Researcher notes
The vulnerable condition is an error-path lifetime mismatch, not the normal successful IRQ setup path. Practical reachability depends on inducing or encountering a partial request_irq() failure and a later interrupt. The bundle provides three stable-kernel corrections but does not map each commit to a specific release or distribution package.
Mitigation direction
- Identify hosts using the octeon_ep_vf driver and prioritize those systems.
- Check distribution or kernel vendor advisories for package-specific affected and fixed versions.
- Upgrade to a vendor-supported kernel containing the referenced upstream correction.
- Apply normal kernel maintenance controls until affected hosts can be updated.
Validation and detection
- Record running kernel and distribution package versions on systems using the driver.
- Confirm package status against the relevant distribution or kernel vendor advisory.
- Verify the installed kernel includes the matching-dev_id rollback correction.
- After updating, reboot into the corrected kernel and confirm the active version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23013 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/aa05a8371ae4a452df623f7202c72409d3c50e40CVE reference, Linux
- https://git.kernel.org/stable/c/aa4c066229b05fc3d3c5f42693d25b1828533b6eCVE reference, Linux
- https://git.kernel.org/stable/c/f93fc5d12d69012788f82151bee55fce937e1432CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.