CVE-2026-23341

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23341", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.998Z", "datePublished": "2026-03-25T10:27:29.438Z", "dateUpdated": "2026-10-15T10:06:58.305Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-15T10:06:58.305Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Fix crash when destroying a suspended hardware context\n\nIf userspace issues an ioctl to destroy a hardware context that has\nalready been automatically suspended, the driver may crash because the\nmailbox channel pointer is NULL for the suspended context.\n\nFix this by checking the mailbox channel pointer in aie2_destroy_context()\nbefore accessing it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/accel/amdxdna/aie2_message.c"], "versions": [{"version": "b569ff8a1bc1bcd4fdc6fd334604a654f61237a1", "lessThan": "2d2c32b1b9e32f25214f0cbc818c4d55f7da1d0e", "status": "affected", "versionType": "git"}, {"version": "2611c9616cb52d3ed54a6095d72d18e645a6955a", "lessThan": "a6317704edab95d66a62fc1861d9546284ab678e", "status": "affected", "versionType": "git"}, {"version": "97f27573837ef96b4ba42af463cc800cab615c0e", "lessThan": "8363c02863332992a1822688da41f881d88d1631", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/accel/amdxdna/aie2_message.c"], "versions": [{"version": "6.19.4", "lessThan": "6.19.7", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.4", "versionEndExcluding": "6.19.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2d2c32b1b9e32f25214f0cbc818c4d55f7da1d0e"}, {"url": "https://git.kernel.org/stable/c/a6317704edab95d66a62fc1861d9546284ab678e"}, {"url": "https://git.kernel.org/stable/c/8363c02863332992a1822688da41f881d88d1631"}], "title": "accel/amdxdna: Fix crash when destroying a suspended hardware context", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/accel/amdxdna/aie2_message.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2d2c32b1b9e32f25214f0cbc818c4d55f7da1d0e", "status": "affected", "version": "b569ff8a1bc1bcd4fdc6fd334604a654f61237a1", "versionType": "git"}, {"lessThan": "a6317704edab95d66a62fc1861d9546284ab678e", "status": "affected", "version": "2611c9616cb52d3ed54a6095d72d18e645a6955a", "versionType": "git"}, {"lessThan": "8363c02863332992a1822688da41f881d88d1631", "status": "affected", "version": "97f27573837ef96b4ba42af463cc800cab615c0e", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/accel/amdxdna/aie2_message.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.19.7", "status": "affected", "version": "6.19.4", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EABFC675-2A5E-4569-92F7-1E8942DA0683", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Fix crash when destroying a suspended hardware context\n\nIf userspace issues an ioctl to destroy a hardware context that has\nalready been automatically suspended, the driver may crash because the\nmailbox channel pointer is NULL for the suspended context.\n\nFix this by checking the mailbox channel pointer in aie2_destroy_context()\nbefore accessing it."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\naccel/amdxdna: Corrige un fallo al destruir un contexto de hardware suspendido\n\nSi el espacio de usuario emite un ioctl para destruir un contexto de hardware que ya ha sido suspendido autom\u00e1ticamente, el controlador puede fallar porque el puntero del canal del buz\u00f3n es NULL para el contexto suspendido.\n\nSoluciona esto comprobando el puntero del canal del buz\u00f3n en aie2_destroy_context() antes de acceder a \u00e9l."}], "id": "CVE-2026-23341", "lastModified": "2026-10-15T11:17:28.710", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-03-25T11:16:32.013", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2d2c32b1b9e32f25214f0cbc818c4d55f7da1d0e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8363c02863332992a1822688da41f881d88d1631"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a6317704edab95d66a62fc1861d9546284ab678e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: accel/amdxdna: Fix crash when destroying a suspended hardware context", "id": "2451182", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451182"}, "csaw": false, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's accel/amdxdna component. A local user can exploit this by issuing an ioctl to destroy a hardware context that has been automatically suspended. This can lead to a system crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-23341", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23341\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23341\nhttps://lore.kernel.org/linux-cve-announce/2026032534-CVE-2026-23341-3f7b@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2611c9616cb52d3ed54a6095d72d18e645a6955a,a6317704edab95d66a62fc1861d9546284ab678e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[97f27573837ef96b4ba42af463cc800cab615c0e,8363c02863332992a1822688da41f881d88d1631)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0-rc1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.0-rc1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T17:11:51.485278+00:00", "value": {"mitigation_remediation": ["Apply the latest Linux kernel update that includes the accel/amdxdna fix, ensuring the patched commit is present.", "Reboot the system so the kernel and driver reload with the new code.", "If upgrading is not immediately possible, restrict access to the device file for accel/amdxdna by setting restrictive permissions or using SELinux/AppArmor rules, and consider applying a seccomp filter to block the ioctl that destroys contexts from untrusted processes."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The flaw is present in any Linux kernel that includes the accel/amdxdna driver before the patch is applied. Since the CPE indicates the generic linux_kernel, all distributions using the stock Linux kernel or derivatives that have not incorporated the recent commit remain vulnerable until the driver is updated.", "description_and_impact": "A null pointer dereference in the Linux kernel\u2019s accel/amdxdna driver occurs when a userspace process issues an ioctl to destroy a hardware context that has already been automatically suspended. Deleting the context without checking the mailbox channel pointer causes the driver to crash, leading to a kernel panic and a complete loss of system availability.", "risk_and_exploitability": "The EPSS score is reported as less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation probability is low. Based on the description, it is inferred that an attacker would need to run code on the local machine with sufficient privileges to invoke the vulnerable ioctl, making the attack vector a local privileged user. Although the impact is a system crash, the low likelihood of public exploitation reinforces the importance of applying the fix promptly."}}}}, "created": "2026-03-25T21:32:13.227007+00:00", "updated": "2026-04-28T17:15:21.249616+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}