LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23028: LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy()

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy() In kvm_ioctl_create_device(), kvm_device has allocated memory, kvm_device->destroy() seems to be supposed to free its kvm_device struct, but kvm_ipi_destroy() is not currently doing this, that would lead to a memory leak. So, fix it.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel memory-leak bug in LoongArch KVM device cleanup. A specific virtual interrupt device path allocates a kvm_device object but did not free it on destroy. The source bundle does not show data theft, privilege escalation, public exploitation, or a CVSS score. Business risk is mainly availability on affected LoongArch virtualization hosts.

Executive priority

Treat as a targeted availability maintenance item, not an emergency, unless you operate LoongArch KVM infrastructure. Patch through normal kernel update processes after confirming vendor applicability.

Technical view

The issue is in kvm_ipi_destroy(): memory allocated for kvm_device in kvm_ioctl_create_device() was not released. The upstream fix frees the kvm_device structure during IPI device destruction. Affected evidence points to Linux kernel versions around 6.13 through 6.19 and specific kernel commits, but downstream vendor package impact is not provided.

Likely exposure

Exposure appears limited to Linux systems on LoongArch using KVM. Organizations without LoongArch virtualization are unlikely to be affected. Kernel package backport status is not stated in the bundle, so distribution-specific exposure needs vendor verification.

Exploitation context

The CVE is not listed as KEV in the provided data, and no cited source states active exploitation. The described impact is a memory leak, which could contribute to resource exhaustion, but the bundle does not establish practical exploitability or attack prerequisites.

Researcher notes

The public description is narrow: a kvm_device object allocated by kvm_ioctl_create_device() was not freed by kvm_ipi_destroy(). No CVSS, CWE, exploit status, or downstream package mapping is included, limiting confidence in severity beyond the memory-leak finding.

Mitigation direction

  • Apply kernel updates that include the referenced stable fixes.
  • Check Linux distribution advisories for backported LoongArch KVM fixes.
  • Prioritize affected LoongArch virtualization hosts over non-KVM systems.
  • If updates are unavailable, follow vendor guidance for temporary mitigations.

Validation and detection

  • Inventory hosts running Linux on LoongArch hardware.
  • Identify whether KVM is enabled or used on those hosts.
  • Compare kernel packages against vendor advisories and fixed stable commits.
  • Review virtualization hosts for unusual memory growth under normal workloads.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23028 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc532de5a67a70f8533d495f8f2aaa9a0491c3ad0, c532de5a67a70f8533d495f8f2aaa9a0491c3ad0unaffected
LinuxLinux6.13, 0, 6.18.7, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.