The Linux kernel vulnerability identified as CVE-2026-23387 involves a double-put in the cs42l43_pin_probe() function of the pinctrl cirrus driver. The issue arises because devm_add_action_or_reset() already invokes the cleanup action on failure, and an explicit put call causes a double-put, potentially leading to memory corruption or instability. This vulnerability is part of a broader set of Linux kernel security fixes addressing multiple subsystems and architectures. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a local attacker with low privileges can cause high impact on confidentiality, integrity, and availability. The vendor advisory from Ubuntu confirms patches are available and recommends updating to fixed kernel versions and rebooting. Due to an ABI change, recompilation of third-party kernel modules is required after update.

Exploitation of this vulnerability can lead to high impact on system confidentiality, integrity, and availability due to potential memory corruption from the double-put operation. The CVSS vector indicates a local attacker with low privileges can exploit this without user interaction. The vulnerability may cause system instability or compromise. No known exploits in the wild have been reported. This issue is one among several Linux kernel vulnerabilities fixed in the same update.

A patch is available and included in updated Linux kernel packages. Users should apply the official updates for linux-hwe-edge and related kernel packages to versions at or above 6.8.0-1064.72~22.04.1 and equivalents as specified by the vendor. After updating, a system reboot is required to apply the changes. Due to an ABI change, all third-party kernel modules must be recompiled and reinstalled. Follow the vendor advisory instructions for updating and rebuilding modules. No additional mitigation is required beyond applying the official fix.