CVE-2026-23046 — Operation on a Resource after Expiration or Release in Linux
Severity
5.5MEDIUM
No vectorEPSS
0.0%
top 92.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 4
Description
In the Linux kernel, the following vulnerability has been resolved:
virtio_net: fix device mismatch in devm_kzalloc/devm_kfree
Initial rss_hdr allocation uses virtio_device->device,
but virtnet_set_queues() frees using net_device->device.
This device mismatch causing below devres warning
[ 3788.514041] ------------[ cut here ]------------
[ 3788.514044] WARNING: drivers/base/devres.c:1095 at devm_kfree+0x84/0x98, CPU#16: vdpa/1463
[ 3788.514054] Modules linked in: octep_vdpa virtio_net virtio…
Affected Packages4 packages
▶CVEListV5linux/linux4944be2f5ad8c74b93e4e272f3a0f1a136bbc438 — a5e2d902f64c76169c771f584559c82b588090e3+2
🔴Vulnerability Details
3GHSA▶
GHSA-ppvw-hxrc-mgfc: In the Linux kernel, the following vulnerability has been resolved:
virtio_net: fix device mismatch in devm_kzalloc/devm_kfree
Initial rss_hdr alloc↗2026-02-04
OSV▶
CVE-2026-23046: In the Linux kernel, the following vulnerability has been resolved: virtio_net: fix device mismatch in devm_kzalloc/devm_kfree Initial rss_hdr allocat↗2026-02-04