CVE-2026-23090 [Medium] | Information Disclosure in Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: slimbus: core: fix device reference leak on report present Slimbus devices can be allocated dynamically upon reception of report-present messages. Make sure to drop the reference taken when looking up already registered devices. Note that this requires taking an extra reference in case the device has not yet been registered and has to be allocated.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.02%	0.12%	+0.10%
2	2026-02-05	—	0.02%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.02%

0.12%

+0.10%

2026-02-05

—

0.02%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.5	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.8	3.6	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.5

3.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.8

3.6

[email protected]

OS Trackers for CVE-2026-23090

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2026-23090 not yet assigned priority: Debian including 2 source packages (linux, linux-6.1), 6 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 6.	https://security-tracker.debian.org/tracker/CVE-2026-23090
`redhat`	—	—	https://access.redhat.com/security/cve/CVE-2026-23090
`suse`	medium	CVE-2026-23090 severity moderate: SUSE including 412 source package names (2.1.3-6.124:kernel-default-base-6.4.0-40.1.21.17, 2.1.3-7.105:kernel-default-6.4.0-40.1, …), 619 product×package rows across 46 product lines (Container suse/sl-micro/6.0/base-os-container, Container suse/sl-micro/6.0/kvm-os-container, … (46 product lines)): Fixed 308, Known Affected 231, Known Not Affected 55, First Fixed 25.	https://www.suse.com/security/cve/CVE-2026-23090/
`ubuntu`	medium	CVE-2026-23090 medium priority: Ubuntu including 157 source packages (linux, linux-allwinner-5.19, …), 1256 status rows across 8 suites (bionic, focal, jammy, noble, questing, trusty, upstream, xenial): DNE 871, ignored 169, released 102, needed 74, not-affected 24, pending 16.	https://ubuntu.com/security/CVE-2026-23090

Affected software / configurations for CVE-2026-23090

Vendor	Product	Version	Raw CPE
linux	linux_kernel	>= 4.16, < 5.10.249	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.11, < 5.15.199	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.16, < 6.1.162	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.2, < 6.6.122	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.7, < 6.12.68	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.13, < 6.18.8	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	6.19	cpe:2.3:o:linux:linux_kernel:6.19:rc1::::::
linux	linux_kernel	6.19	cpe:2.3:o:linux:linux_kernel:6.19:rc2::::::
linux	linux_kernel	6.19	cpe:2.3:o:linux:linux_kernel:6.19:rc3::::::
linux	linux_kernel	6.19	cpe:2.3:o:linux:linux_kernel:6.19:rc4::::::
linux	linux_kernel	6.19	cpe:2.3:o:linux:linux_kernel:6.19:rc5::::::
linux	linux_kernel	6.19	cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::

References for CVE-2026-23090

URL	Tags
https://git.kernel.org/stable/c/02b78bbfbafe49832e508079148cb87cdfa55825	Patch
https://git.kernel.org/stable/c/2ddc09f6a0a221b1d91a7cbc8cc2cefdbd334fe6	Patch
https://git.kernel.org/stable/c/54de72a7aabc0749938d7a2833a0c1a5d3ed7ac9	Patch
https://git.kernel.org/stable/c/6602bb4d1338e92b5838e50322b87697bdbd2ee0	Patch
https://git.kernel.org/stable/c/9391380eb91ea5ac792aae9273535c8da5b9aa01	Patch
https://git.kernel.org/stable/c/948615429c9f2ac9d25d4e1f1a4472926b217a9a	Patch
https://git.kernel.org/stable/c/b1217e40705b2f6d311c197b12866752656217ff	Patch

URL

CVE-2026-23090 | slimbus: core: fix device reference leak on report present

Exploit prediction scoring system (EPSS) score for CVE-2026-23090

Common vulnerability scoring system (CVSS) metrics for CVE-2026-23090

Weakness enumeration for CVE-2026-23090

OS Trackers for CVE-2026-23090

Affected software / configurations for CVE-2026-23090

References for CVE-2026-23090