CVE-2026-23313 - Vulnerability Details

- i40e: Fix preempt count leak in napi poll tracepoint

Description

In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix preempt count leak in napi poll tracepoint

Using get_cpu() in the tracepoint assignment causes an obvious preempt
count leak because nothing invokes put_cpu() to undo it:

softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100, exited with 00000101?

This clearly has seen a lot of testing in the last 3+ years...

Use smp_processor_id() instead.

Published: 2026-03-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel’s i40e network driver, a tracepoint incorrectly employs get_cpu() without a matching put_cpu() call, causing the preempt_count to remain incremented. This results in a preemption counter leak.

Affected Systems

Any Linux system running a kernel that includes the unpatched i40e driver. No specific kernel version range is provided, so all generic Linux kernel builds that compile the i40e module are potentially affected.

Risk and Exploitability

The vulnerability has a CVSS score of 5.5, indicating moderate severity. Its EPSS score is below 1 %, showing a low probability of exploitation, and it is not listed in CISA KEV. The flaw resides in kernel driver code, so exploitation would require code execution within the kernel context and is not known to be remotely exploitable from user space.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6d4d584a7ea8fc8d2be77545cb503118c193738a`	affected	< fa5d5baf67f619c7aa70697a194b5a9edd9f5bb7
`6d4d584a7ea8fc8d2be77545cb503118c193738a`	affected	< b7e91827e1cf89cd34ad11dc8f8c010b70ab786e
`6d4d584a7ea8fc8d2be77545cb503118c193738a`	affected	< 9e0f091821571f0da387462803ee42f0bb157582
`6d4d584a7ea8fc8d2be77545cb503118c193738a`	affected	< dca4ea596a3b0a1b82bc1d9f3e4d88bd9ad9561f
`6d4d584a7ea8fc8d2be77545cb503118c193738a`	affected	< 4b3d54a85bd37ebf2d9836f0d0de775c0ff21af9

Linux

affected

Version	Status	Constraints
`6.2`	affected	—
`0`	unaffected	< 6.2
`6.6.136`	unaffected	≤ 6.6.*
`6.12.77`	unaffected	≤ 6.12.*
`6.18.17`	unaffected	≤ 6.18.*
`6.19.7`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6d4d584a7ea8fc8d2be77545cb503118c193738a,b7e91827e1cf89cd34ad11dc8f8c010b70ab786e)`	affected	code_commit	—
`[6d4d584a7ea8fc8d2be77545cb503118c193738a,9e0f091821571f0da387462803ee42f0bb157582)`	affected	code_commit	—
`[6d4d584a7ea8fc8d2be77545cb503118c193738a,dca4ea596a3b0a1b82bc1d9f3e4d88bd9ad9561f)`	affected	code_commit	—
`[6d4d584a7ea8fc8d2be77545cb503118c193738a,4b3d54a85bd37ebf2d9836f0d0de775c0ff21af9)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.2`	affected	generic	—
`[0,6.2)`	unaffected	generic	—
`[6.12.77,6.13.0)`	unaffected	generic	—
`[6.18.17,6.19.0)`	unaffected	generic	—
`[6.19.7,6.20.0)`	unaffected	generic	—
`[7.0-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the Linux kernel patch that replaces get_cpu() with smp_processor_id() in the i40e driver.
Reboot the system to load the updated kernel module and ensure the change takes effect.
If the patch cannot be applied immediately, consider temporarily disabling the i40e network driver until the fix is available to prevent the preempt count leak.

Generated by OpenCVE AI on May 26, 2026 at 17:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6238-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00018.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4b3d54a85bd37ebf2d9836f0d0de775c0ff21af9
https://git.kernel.org/stable/c/9e0f091821571f0da387462803ee42f0bb157582
https://git.kernel.org/stable/c/b7e91827e1cf89cd34ad11dc8f8c010b70ab786e
https://git.kernel.org/stable/c/dca4ea596a3b0a1b82bc1d9f3e4d88bd9ad9561f
https://git.kernel.org/stable/c/fa5d5baf67f619c7aa70697a194b5a9edd9f5bb7
https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23313-925e@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23313
https://www.cve.org/CVERecord?id=CVE-2026-23313

History

Tue, 26 May 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-Other
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::

Mon, 27 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/fa5d5baf67f619c7aa70697a194b5a9edd9f5bb7

Thu, 26 Mar 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23313-925e@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23313 https://www.cve.org/CVERecord?id=CVE-2026-23313
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Wed, 25 Mar 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: i40e: Fix preempt count leak in napi poll tracepoint Using get_cpu() in the tracepoint assignment causes an obvious preempt count leak because nothing invokes put_cpu() to undo it: softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100, exited with 00000101? This clearly has seen a lot of testing in the last 3+ years... Use smp_processor_id() instead.
Title		i40e: Fix preempt count leak in napi poll tracepoint
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4b3d54a85bd37ebf2d9836f0d0de775c0ff21af9 https://git.kernel.org/stable/c/9e0f091821571f0da387462803ee42f0bb157582 https://git.kernel.org/stable/c/b7e91827e1cf89cd34ad11dc8f8c010b70ab786e https://git.kernel.org/stable/c/dca4ea596a3b0a1b82bc1d9f3e4d88bd9ad9561f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-03-25T10:27:08.686Z

Updated: 2026-05-11T22:04:28.296Z

Reserved: 2026-01-13T15:37:45.994Z

Link: CVE-2026-23313

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-03-25T11:16:27.623

Modified: 2026-05-26T15:01:30.750

Link: CVE-2026-23313

Redhat

Severity : Low

Publid Date: 2026-03-25T00:00:00Z

Links: CVE-2026-23313 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-26T18:00:14Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object