The Linux kernel vulnerability CVE-2026-23313 involves a preempt count leak in the i40e network driver within the napi poll tracepoint. The root cause is the use of get_cpu() without a matching put_cpu(), leading to an incremented preempt count that is not decremented, causing potential kernel instability or denial of service. The fix replaces get_cpu() with smp_processor_id() to avoid the leak. This issue affects multiple Linux kernel versions prior to 6.8.0 and its variants as used in the linux-hwe-edge product. The vulnerability has a CVSS 3.1 base score of 5.5 (medium severity), with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but with high impact on availability. A patch is available and included in updated kernel packages.

The vulnerability can cause a preempt count leak in the kernel, potentially leading to system instability or denial of service (availability impact). There is no direct impact on confidentiality or integrity. The attack requires local access with low privileges and no user interaction. Exploitation could disrupt normal kernel operation but does not allow privilege escalation or data compromise.

A patch is available and should be applied by updating the Linux kernel to versions 6.8.0 or later (and corresponding patched builds). After updating, a system reboot is required to apply the fix. Due to an ABI change in the kernel update, all third-party kernel modules must be recompiled and reinstalled. Follow the vendor's update instructions carefully to ensure complete remediation.