CVE-2026-23051

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23051", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.950Z", "datePublished": "2026-02-04T16:04:20.777Z", "dateUpdated": "2026-05-11T21:59:03.286Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:59:03.286Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix drm panic null pointer when driver not support atomic\n\nWhen driver not support atomic, fb using plane->fb rather than\nplane->state->fb.\n\n(cherry picked from commit 2f2a72de673513247cd6fae14e53f6c40c5841ef)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_display.c"], "versions": [{"version": "fe151ed7af5425c424a5735ef9fa3d02c828be7f", "lessThan": "a1aedf4053af7dad3772b94b057a7d1f5473055f", "status": "affected", "versionType": "git"}, {"version": "fe151ed7af5425c424a5735ef9fa3d02c828be7f", "lessThan": "9cb6278b44c38899961b36d303d7b18b38be2a6e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_display.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.7", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a1aedf4053af7dad3772b94b057a7d1f5473055f"}, {"url": "https://git.kernel.org/stable/c/9cb6278b44c38899961b36d303d7b18b38be2a6e"}], "title": "drm/amdgpu: fix drm panic null pointer when driver not support atomic", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_display.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a1aedf4053af7dad3772b94b057a7d1f5473055f", "status": "affected", "version": "fe151ed7af5425c424a5735ef9fa3d02c828be7f", "versionType": "git"}, {"lessThan": "9cb6278b44c38899961b36d303d7b18b38be2a6e", "status": "affected", "version": "fe151ed7af5425c424a5735ef9fa3d02c828be7f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_display.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix drm panic null pointer when driver not support atomic\n\nWhen driver not support atomic, fb using plane->fb rather than\nplane->state->fb.\n\n(cherry picked from commit 2f2a72de673513247cd6fae14e53f6c40c5841ef)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amdgpu: corregir p\u00e1nico de drm por puntero nulo cuando el controlador no soporta at\u00f3mico\n\nCuando el controlador no soporta at\u00f3mico, fb usa plane->fb en lugar de plane->state->fb.\n\n(extra\u00eddo de la confirmaci\u00f3n 2f2a72de673513247cd6fae14e53f6c40c5841ef)"}], "id": "CVE-2026-23051", "lastModified": "2026-06-17T10:20:46.573", "metrics": {}, "published": "2026-02-04T17:16:15.763", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9cb6278b44c38899961b36d303d7b18b38be2a6e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a1aedf4053af7dad3772b94b057a7d1f5473055f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: drm/amdgpu: fix drm panic null pointer when driver not support atomic", "id": "2436781", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436781"}, "csaw": false, "details": ["No description is available for this CVE."], "name": "CVE-2026-23051", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23051\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23051\nhttps://lore.kernel.org/linux-cve-announce/2026020450-CVE-2026-23051-7ad8@gregkh/T"]}

{"analysis": {"en": {"generated_at": "2026-04-18T13:58:20.990571+00:00", "value": {"mitigation_remediation": ["Upgrade the Linux kernel to the latest stable release that incorporates commit 2f2a72de673513247cd6fae14e53f6c40c5841ef, or apply the patch manually to an existing kernel.", "Reboot the system after the upgrade to load the corrected kernel and terminate any processes that may have loaded the faulty DRM driver before the reboot.", "Test normal graphics operations and monitor kernel logs for disappearance of the null\u2011pointer panic messages, confirming that the kernel no longer crashes under unsupported atomic operations."], "summary": {"action": "Apply Patch", "impact": "Denial of Service (kernel crash)"}, "threat_synthesis": {"affected_systems": "The vulnerability resides in the Linux kernel\u2019s DRM subsystem for AMD GPUs. All kernel releases that contain the buggy code before the patch commit 2f2a72de673513247cd6fae14e53f6c40c5841ef are affected, including current mainline versions and downstream distributions that have not applied the fix. Once the kernel includes the commit, the flaw is mitigated.", "description_and_impact": "A null pointer dereference occurs when the AMD GPU driver operates without atomic support, causing the kernel to panic. The defect can be triggered by sending a crafted DRM request that forces the driver to use the wrong framebuffer pointer, leading to a system\u2011wide denial of service. The most likely attack vector is local or privileged access to the DRM subsystem, which would allow an attacker to trigger the crash by interacting with the faulty driver. Based on the description, it is inferred that such a crafted request and local/privileged access are required for exploitation.", "risk_and_exploitability": "The EPSS score is less than 1\u202f% and the issue is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation. Because an attacker would need to interact with the DRM subsystem\u2014usually requiring local or privileged access\u2014the overall risk to typical deployments is low, though environments with elevated privilege concerns should address the problem promptly. Based on the description, it is inferred that such access is necessary for exploitation."}}}}, "created": "2026-04-18T14:00:02.187662+00:00", "updated": "2026-04-18T14:00:02.187677+00:00", "vendors": [], "weaknesses": ["CWE-476"]}