{
  "cveId": "CVE-2026-23162",
  "url": "https://patchblox.com/security/cve/CVE-2026-23162",
  "summary": "CVE-2026-23162 is fixed in linux on 1 platform by DEBIAN-CVE-2026-23162 (version 6.18.9-1), released February 14, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  drm/xe/nvm: Fix double-free on aux add failure...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  drm/xe/nvm: Fix double-free on aux add failure  After a successful auxiliary_device_init(), aux_dev-\u003Edev.release (xe_nvm_release_dev()) is responsible for the kfree(nvm). When there is failure with auxiliary_device_add(), driver will call auxiliary_device_uninit(), which call put_device(). So that the .release callback will be triggered to free the memory associated with the auxiliary_device.  Move the kfree(nvm) into the auxiliary_device_init() failure path and remove the err goto path to fix below error.  \u0022 [   13.232905] ================================================================== [   13.232911] BUG: KASAN: double-free in xe_nvm_init\u002B0x751/0xf10 [xe] [   13.233112] Free of addr ffff888120635000 by task systemd-udevd/273  [   13.233120] CPU: 8 UID: 0 PID: 273 Comm: systemd-udevd Not tainted 6.19.0-rc2-lgci-xe-kernel\u002B #225 PREEMPT(voluntary) ... [   13.233125] Call Trace: [   13.233126]  \u003CTASK\u003E [   13.233127]  dump_stack_lvl\u002B0x7f/0xc0 [   13.233132]  print_report\u002B0xce/0x610 [   13.233136]  ? kasan_complete_mode_report_info\u002B0x5d/0x1e0 [   13.233139]  ? xe_nvm_init\u002B0x751/0xf10 [xe] ... \u0022  v2: drop err goto path. (Alexander)  (cherry picked from commit a3187c0c2bbd947ffff97f90d077ac88f9c2a215)",
  "published": "2026-02-14T16:15:56Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00132,
  "epssPercentile": 0.0278,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.18.9-1",
      "fix": "DEBIAN-CVE-2026-23162",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-23162",
      "released": "2026-02-14T16:15:56Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}