CVE-2026-23013

// CVE-2026-23013 PoC - Kernel Module to trigger the IRQ dev_id mismatch // This PoC demonstrates the vulnerability in octeon_ep_vf driver's IRQ rollback // Note: This is a conceptual PoC for educational purposes only #include <linux/kernel.h> #include <linux/module.h> #include <linux/pci.h> MODULE_LICENSE("GPL"); MODULE_AUTHOR("Security Researcher"); MODULE_DESCRIPTION("PoC for CVE-2026-23013"); // Simulate the vulnerable code path void simulate_vulnerable_irq_request(struct device *dev, int num_vectors) { struct octep_vf_irq *irqs; int i, ret; irqs = kcalloc(num_vectors, sizeof(*irqs), GFP_KERNEL); if (!irqs) return; // Request interrupts - simulating the vulnerable scenario for (i = 0; i < num_vectors; i++) { // VULNERABILITY: Using ioq_vector as dev_id ret = request_irq(irqs[i].vector, handler, 0, "octep_vf", &irqs[i]); if (ret) { // VULNERABILITY: Rollback uses 'oct' instead of &irqs[i] // This causes dev_id mismatch in free_irq() while (i-- > 0) { free_irq(irqs[i].vector, dev); // Wrong dev_id! } goto cleanup; } } // Normal operation continues... cleanup: // Later cleanup might free irqs while handler still registered kfree(irqs); // This creates use-after-free condition } static int __init cve_2026_23013_init(void) { printk(KERN_INFO "CVE-2026-23013 PoC loaded\n"); printk(KERN_INFO "Vulnerability: IRQ dev_id mismatch in octeon_ep_vf rollback\n"); return 0; } static void __exit cve_2026_23013_exit(void) { printk(KERN_INFO "CVE-2026-23013 PoC unloaded\n"); } module_init(cve_2026_23013_init); module_exit(cve_2026_23013_exit); // Trigger conditions: // 1. Load octeon_ep_vf driver on vulnerable kernel // 2. Trigger partial MSI-X interrupt allocation failure // 3. Observe IRQ handler still registered after rollback // 4. Interrupt after driver cleanup triggers use-after-free

{"cve": {"id": "CVE-2026-23013", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-01-25T15:15:56.173", "lastModified": "2026-04-03T14:16:22.217", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback\n\noctep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to\nioq_vector. If request_irq() fails part-way, the rollback loop calls\nfree_irq() with dev_id set to 'oct', which does not match the original\ndev_id and may leave the irqaction registered.\n\nThis can keep IRQ handlers alive while ioq_vector is later freed during\nunwind/teardown, leading to a use-after-free or crash when an interrupt\nfires.\n\nFix the error path to free IRQs with the same ioq_vector dev_id used\nduring request_irq()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: octeon_ep_vf: corregir la falta de coincidencia de dev_id de free_irq en la reversión de IRQ\n\noctep_vf_request_irqs() solicita IRQs de cola MSI-X con dev_id establecido en ioq_vector. Si request_irq() falla a mitad de camino, el bucle de reversión llama a free_irq() con dev_id establecido en 'oct', lo que no coincide con el dev_id original y puede dejar la irqaction registrada.\n\nEsto puede mantener los manejadores de IRQ activos mientras ioq_vector es liberado posteriormente durante el desenrollado/desmontaje, lo que lleva a un uso después de liberación o un fallo cuando se dispara una interrupción.\n\nCorregir la ruta de error para liberar IRQs con el mismo dev_id de ioq_vector utilizado durante request_irq()."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.0, "impactScore": 5.9}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.1", "versionEndExcluding": "6.12.67", "matchCriteriaId": "89E789F9-62FD-41A3-B2A9-965C05F50BB1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.7", "matchCriteriaId": "99FF3E05-0E7A-44E9-8E47-BF6F1F8EC436"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*", "matchCriteriaId": "3F2A4A3D-068A-4CF2-A09F-9C7937DDB0A5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*", "matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/aa05a8371ae4a452df623f7202c72409d3c50e40", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/aa4c066229b05fc3d3c5f42693d25b1828533b6e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/f93 ... (truncated)