CVE-2026-23176 platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
A memory leak in the Toshiba HAPS kernel driver allows local attackers to cause resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23176?
CVE-2026-23176 is a memory corruption vulnerability in Linux, published on 14 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
toshiba_haps_add() leaks the haps object allocated by it if it returns an error after allocating that object successfully.
toshiba_haps_remove() does not free the object pointed to by toshiba_haps before clearing that pointer, so it becomes unreachable allocated memory.
Address these memory leaks by using devm_kzalloc() for allocating the memory in question.
Which versions are affected by CVE-2026-23176?
How do I fix CVE-2026-23176?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-23176 being exploited?
There is no known exploitation of CVE-2026-23176 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-23176, DEBIAN-CVE-2026-23176, GHSA-vm5x-8w9j-f2rm, ROOT-OS-DEBIAN-11-CVE-2026-23176, ROOT-OS-DEBIAN-12-CVE-2026-23176, ROOT-OS-DEBIAN-13-CVE-2026-23176 and 3 more.