CVE-2026-23358

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23358", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.000Z", "datePublished": "2026-03-25T10:27:42.327Z", "dateUpdated": "2026-11-05T21:33:42.084Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:05:19.301Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix error handling in slot reset\n\nIf the device has not recovered after slot reset is called, it goes to\nout label for error handling. There it could make decision based on\nuninitialized hive pointer and could result in accessing an uninitialized\nlist.\n\nInitialize the list and hive properly so that it handles the error\nsituation and also releases the reset domain lock which is acquired\nduring error_detected callback.\n\n(cherry picked from commit bb71362182e59caa227e4192da5a612b09349696)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"], "versions": [{"version": "732c6cefc1ecfc8de5d7a2029480798655d979d8", "lessThan": "73e8bdf14248136459753252a438177df7ed8c7c", "status": "affected", "versionType": "git"}, {"version": "732c6cefc1ecfc8de5d7a2029480798655d979d8", "lessThan": "baf4e7968911635eb816870af0ea587ac1457052", "status": "affected", "versionType": "git"}, {"version": "732c6cefc1ecfc8de5d7a2029480798655d979d8", "lessThan": "b57c4ec98c17789136a4db948aec6daadceb5024", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/73e8bdf14248136459753252a438177df7ed8c7c"}, {"url": "https://git.kernel.org/stable/c/baf4e7968911635eb816870af0ea587ac1457052"}, {"url": "https://git.kernel.org/stable/c/b57c4ec98c17789136a4db948aec6daadceb5024"}], "title": "drm/amdgpu: Fix error handling in slot reset", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23358", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:27:57.782545Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:33:42.084Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23358", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:27:57.782545Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:27:58.824Z"}}], "cna": {"title": "drm/amdgpu: Fix error handling in slot reset", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "732c6cefc1ecfc8de5d7a2029480798655d979d8", "lessThan": "73e8bdf14248136459753252a438177df7ed8c7c", "versionType": "git"}, {"status": "affected", "version": "732c6cefc1ecfc8de5d7a2029480798655d979d8", "lessThan": "baf4e7968911635eb816870af0ea587ac1457052", "versionType": "git"}, {"status": "affected", "version": "732c6cefc1ecfc8de5d7a2029480798655d979d8", "lessThan": "b57c4ec98c17789136a4db948aec6daadceb5024", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.17", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.7", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/73e8bdf14248136459753252a438177df7ed8c7c"}, {"url": "https://git.kernel.org/stable/c/baf4e7968911635eb816870af0ea587ac1457052"}, {"url": "https://git.kernel.org/stable/c/b57c4ec98c17789136a4db948aec6daadceb5024"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix error handling in slot reset\n\nIf the device has not recovered after slot reset is called, it goes to\nout label for error handling. There it could make decision based on\nuninitialized hive pointer and could result in accessing an uninitialized\nlist.\n\nInitialize the list and hive properly so that it handles the error\nsituation and also releases the reset domain lock which is acquired\nduring error_detected callback.\n\n(cherry picked from commit bb71362182e59caa227e4192da5a612b09349696)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:05:19.301Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23358", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:33:42.084Z", "dateReserved": "2026-01-13T15:37:46.000Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-03-25T10:27:42.327Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "73e8bdf14248136459753252a438177df7ed8c7c", "status": "affected", "version": "732c6cefc1ecfc8de5d7a2029480798655d979d8", "versionType": "git"}, {"lessThan": "baf4e7968911635eb816870af0ea587ac1457052", "status": "affected", "version": "732c6cefc1ecfc8de5d7a2029480798655d979d8", "versionType": "git"}, {"lessThan": "b57c4ec98c17789136a4db948aec6daadceb5024", "status": "affected", "version": "732c6cefc1ecfc8de5d7a2029480798655d979d8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.17", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5B092616-17E9-4C58-A0D5-624A8FAE8D23", "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.16.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*", "matchCriteriaId": "6238B17D-C12B-458F-A138-97039BFC4595", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix error handling in slot reset\n\nIf the device has not recovered after slot reset is called, it goes to\nout label for error handling. There it could make decision based on\nuninitialized hive pointer and could result in accessing an uninitialized\nlist.\n\nInitialize the list and hive properly so that it handles the error\nsituation and also releases the reset domain lock which is acquired\nduring error_detected callback.\n\n(cherry picked from commit bb71362182e59caa227e4192da5a612b09349696)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amdgpu: Corregir el manejo de errores en el reinicio de ranura\n\nSi el dispositivo no se ha recuperado despu\u00e9s de que se llama al reinicio de ranura, va a la etiqueta out para el manejo de errores. All\u00ed podr\u00eda tomar una decisi\u00f3n basada en un puntero hive no inicializado y podr\u00eda resultar en el acceso a una lista no inicializada.\n\nInicializar la lista y hive correctamente para que maneje la situaci\u00f3n de error y tambi\u00e9n libere el bloqueo del dominio de reinicio que se adquiere durante la llamada de retorno error_detected.\n\n(seleccionado de la confirmaci\u00f3n bb71362182e59caa227e4192da5a612b09349696)"}], "id": "CVE-2026-23358", "lastModified": "2026-11-05T22:18:16.937", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23358", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:27:57.782545Z", "version": "2.0.3"}}]}, "published": "2026-03-25T11:16:34.610", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/73e8bdf14248136459753252a438177df7ed8c7c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b57c4ec98c17789136a4db948aec6daadceb5024"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/baf4e7968911635eb816870af0ea587ac1457052"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/amdgpu: Fix error handling in slot reset", "id": "2451224", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451224"}, "csaw": false, "cwe": "CWE-824", "details": ["A flaw was found in the Linux kernel's `drm/amdgpu` driver. During slot reset error handling, the system could attempt to access an uninitialized list due to an uninitialized pointer. This could lead to system instability or a denial of service."], "name": "CVE-2026-23358", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23358\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23358\nhttps://lore.kernel.org/linux-cve-announce/2026032538-CVE-2026-23358-1042@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[732c6cefc1ecfc8de5d7a2029480798655d979d8,73e8bdf14248136459753252a438177df7ed8c7c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[732c6cefc1ecfc8de5d7a2029480798655d979d8,baf4e7968911635eb816870af0ea587ac1457052)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[732c6cefc1ecfc8de5d7a2029480798655d979d8,b57c4ec98c17789136a4db948aec6daadceb5024)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.17,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T17:05:08.614977+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a release that incorporates the commit bb71362182e59caa227e4192da5a612b09349696, which fixes the uninitialized pointer bug in the AMDGPU driver.", "If a kernel update is not immediately available, apply the patch manually: copy the changes from the referenced commit into your kernel source, rebuild the kernel, and reload the amdgpu module.", "Continuously monitor system logs for messages related to amdgpu slot resets to ensure the issue is resolved."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The flaw affects systems running the Linux kernel when the AMDGPU DRM driver is in use. No specific kernel version ranges are listed, so any kernel that includes the vulnerable code path prior to the applied fix is potentially impacted.", "description_and_impact": "The vulnerability arises in the AMDGPU driver of the Linux kernel, where an uninitialized pointer to a structure referred to as the hive could be dereferenced during error handling after a slot reset. This is an uninitialized data flaw (CWE-824) and involves improper lock handling (CWE-908). The result is access to an uninitialized list, potentially leading to a kernel crash or undefined kernel behavior. The primary consequence of exploitation is a denial of service on the affected system, as the kernel may abort when the erroneous list is accessed. The CVSS score of 5.5 indicates a medium severity, and the exploit would require a failure in the slot reset process.", "risk_and_exploitability": "The EPSS score is reported as below 1\u202f% and the vulnerability is not present in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. The fix addresses uninitialized data handling and improper lock release, so exploitation would require triggering a slot reset failure. It is inferred that an attacker would need local access to a machine with an AMDGPU device and the ability to invoke the reset operation. With the low EPSS and absence from KEV, the overall risk is considered moderate, primarily limited to local or compromised environments."}}}}, "created": "2026-03-25T21:31:57.519228+00:00", "updated": "2026-04-28T17:15:21.237966+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}