Vulnerability in Linux
CVE-2026-23147
In the Linux kernel, the following vulnerability has been resolved: btrfs: zlib: fix the folio leak on S390 hardware acceleration [BUG] After commit aa60fe12b4f4 ("btrfs: zlib: refactor S390x HW acceleration buffer preparation"), we no longer release the folio of the page cache of folio returned by btrfs_compress_filemap_get_folio() for S390 hardware acceleration path. [CAUSE] Before that commit, we call kumap_local() and folio_put() after handling each folio. Although the timing is not ideal (it release previous folio at the beginning of the loop, and rely on some extra cleanup out of the loop), it at least handles the folio release correctly. Meanwhile the refactored code is easier to read, it lacks the call to release the filemap folio. [FIX] Add the missing folio_put() for copy_data_into_buffer().
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.001 (1.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 1st percentile — 1.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000
Affected products
- Linux — versions aa60fe12b4f49f49fc73e5023f8675e2df1f7805, 6.15, 0
- Linux Kernel — versions 6.19
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-23147?
- CVE-2026-23147 is a medium-severity vulnerability in Linux, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.5/10. Published 2026-02-14.
- How severe is CVE-2026-23147?
- Medium severity. CVSS v3 base score is 5.5 out of 10.