Executive brief
A memory leak vulnerability was identified in the Linux kernel's regmap subsystem. This component is responsible for managing hardware register access. An attacker could exploit this to cause a gradual depletion of system memory, potentially leading to a system crash or service outage.
Technical details
A memory leak (CWE-401) exists in drivers/base/regmap/regcache-maple.c within the regcache_maple_write() function. The function allocates a new memory block ('entry') to merge adjacent register ranges but fails to release this memory if the subsequent mas_store_gfp() call fails. A local attacker could potentially trigger this failure path repeatedly to exhaust system memory (Denial of Service). The issue has been resolved by adding a kfree(entry) call in the error handling path. Patches are available for multiple stable kernel branches including 6.6.y, 6.12.y, and 6.18.y.
Affected products
- Linux Linux Kernel 6.4 to 6.6.124, 6.7 to 6.12.70, 6.13 to 6.18.10, 6.19-rc1 to 6.19-rc6
Timeline
- 2026-01-05: patched: Initial patch submitted by Kaushlendra Kumar
- 2026-03-18: disclosed: CVE-2026-23260 published
- 2026-05-29: advisory: NVD enrichment and analysis completed