Junglewise Threat Intelligence

CVE-2026-23026: Linux Kernel memory leak in Qualcomm GPI DMA driver

CVE-2026-23026 · Severity: medium · CVSS 5.5 · Published 2026-01-31

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A memory leak vulnerability was identified in the Qualcomm GPI DMA driver within the Linux kernel. This issue occurs when the system fails to reallocate memory for peripheral configurations, causing the original memory to become unreachable. In practice, this could allow a local attacker to gradually exhaust system memory, potentially leading to a system crash or denial of service.

Technical details

A memory leak exists in drivers/dma/qcom/gpi.c within the gpi_peripheral_config() function. The vulnerability is caused by the improper use of krealloc(); when krealloc() fails and returns NULL, the code directly assigns this NULL value to the original pointer (gchan->config), losing the reference to the previously allocated memory. This makes the original memory unreachable and impossible to free. An attacker with local access could trigger this condition to cause a kernel memory leak, eventually leading to a Denial of Service (DoS) via memory exhaustion. The fix introduces a temporary variable to ensure the original pointer is preserved if reallocation fails.

Affected products

  • Linux Linux Kernel 5.11.1 to 5.15.199, 5.16 to 6.1.162, 6.2 to 6.6.122, 6.7 to 6.12.67, 6.13 to 6.18.7

Timeline

  • 2025-10-29: other: Patch submitted by researcher
  • 2026-01-31: disclosed: CVE published
  • 2026-01-11: patched: Fix committed to stable tree

References