5.5

CVE-2026-23164: linux

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2026-23164DEBIAN-CVE-2026-23164
Published 14-02-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-23164 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.6% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.13%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 30 · Related 28
MGASA-2026-0097MGASA-2026-0098USN-8162-1USN-8180-1USN-8180-2USN-8180-3

Timeline

  1. 14-02-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: rocker: fix memory leak in rocker_world_port_post_fini() In rocker_world_port_pre_init(), rocker_port->wpriv is allocated with kzalloc(wops->port_priv_size, GFP_KERNEL). However, in rocker_world_port_post_fini(), the memory is only freed when wops->port_post_fini callback is set: if (!wops->port_post_fini) return; wops->port_post_fini(rocker_port); kfree(rocker_port->wpriv); Since rocker_ofdpa_ops does not implement port_post_fini callback (it is NULL), the wpriv memory allocated for each port is never freed when ports are removed. This leads to a memory leak of sizeof(struct ofdpa_port) bytes per port on every device removal. Fix this by always calling kfree(rocker_port->wpriv) regardless of whether the port_post_fini callback exists.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.13%

Chance of exploitation in the next 30 days

Percentile

3%

Versus all other CVEs

30-day change

+0.01 pp

From 0.12% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.13%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu155 products
  • linuxAll versions (No fix recorded) | < 5.15.0-176.186 | < 6.8.0-117.117
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1105.112 | < 6.8.0-1055.58
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ e420114eef4a3a5025a243b89b0dc343101e3d3c, < 2a3a64d75d2d0727da285749476761ebcad557a3 | ≥ e420114eef4a3a5025a243b89b0dc343101e3d3c, < b11e6f926480ab0939fec44781f28558c54be4e7 | ≥ e420114eef4a3a5025a243b89b0dc343101e3d3c, < 8ce2e85889939c02740b4245301aa5c35fc94887 | ≥ e420114eef4a3a5025a243b89b0dc343101e3d3c, < d448bf96889f1905e740c554780f5c9fa0440566 | ≥ e420114eef4a3a5025a243b89b0dc343101e3d3c, < d8723917efda3b4f4c3de78d1ec1e1af015c0be1 | ≥ e420114eef4a3a5025a243b89b0dc343101e3d3c, < dce375f4afc348c310d171abcde7ec1499a4c26a | ≥ e420114eef4a3a5025a243b89b0dc343101e3d3c, < 8d7ba71e46216b8657a82ca2ec118bc93812a4d0 | 4.6
  • linux_kernel≥ 4.6, < 5.10.249 | ≥ 5.11, < 5.15.199 | ≥ 5.16, < 6.1.162 | ≥ 6.2, < 6.6.123 | ≥ 6.7, < 6.12.69 | ≥ 6.13, < 6.18.9 | 6.19:rc1 | 6.19:rc2 | 6.19:rc3 | 6.19:rc4 | 6.19:rc5 | 6.19:rc6 | 6.19:rc7
Debian1 product
  • linux< 6.1.162-1 | < 6.12.69-1 | < 6.18.9-1

3 vendors · 158 products

References

40 links
Show all 40 references