CVE-2026-23063: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23063 Overview

A race condition vulnerability has been identified in the Linux kernel's UACCE (Unified/User-space-access-intended Accelerator Framework) subsystem. The vulnerability exists in the queue release mechanism, where directly calling put_queue cannot guarantee that resources of uacce_queue have been fully released beforehand. This can lead to a NULL pointer dereference when uacce_fops_release and uacce_remove execute concurrently, particularly during forced poweroff scenarios while accelerators are still active.

Critical Impact
Local attackers can potentially cause system instability or denial of service through NULL pointer dereference when accelerator resources are improperly released during concurrent operations.

Affected Products

Linux kernel with UACCE subsystem enabled
Systems using user-space accelerator frameworks
Virtualization environments utilizing hardware accelerators

Discovery Timeline

February 4, 2026 - CVE CVE-2026-23063 published to NVD
February 5, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23063

Vulnerability Analysis

The vulnerability stems from improper state management in the UACCE queue handling code. When executing poweroff -f in a virtualized environment while accelerators are still operational, a race condition can occur between uacce_fops_release and uacce_remove. This race condition allows uacce_put_queue within uacce_fops_release to access a NULL ops pointer, leading to a NULL pointer dereference.

The UACCE subsystem defines queue states as follows:

UACCE_Q_ZOMBIE: Initial state
UACCE_Q_INIT: After opening uacce device
UACCE_Q_STARTED: After start is issued via ioctl

The vulnerability occurs because the original implementation did not properly check these states before accessing queue resources, leading to potential use of freed or NULL pointers during concurrent operations.

Root Cause

The root cause is a missing state synchronization mechanism in the queue release path. The original code directly called put_queue for the UACCE_CMD_PUT_Q command without ensuring that all dependent resources were properly released. This lack of proper state management allows a race window where one execution path may free resources while another path still attempts to access them.

Attack Vector

The vulnerability is exploitable locally by triggering concurrent queue release operations. An attacker with local access can potentially exploit this race condition by:

Initiating accelerator operations through the UACCE interface
Forcing a system poweroff or triggering concurrent device removal
Exploiting the timing window where uacce_fops_release accesses freed ops pointer

The vulnerability manifests in the uacce_put_queue function when it attempts to dereference the ops pointer that may have already been freed by a concurrent uacce_remove operation. The fix introduces a stop_queue operation for the UACCE_CMD_PUT_Q command and defers the put_queue operation to the final resource release, with proper state checks to prevent accessing freed pointers.

Detection Methods for CVE-2026-23063

Indicators of Compromise

Kernel panic messages referencing NULL pointer dereference in UACCE-related functions
System logs showing unexpected accelerator device removal during active operations
Crash dumps indicating race conditions in uacce_fops_release or uacce_remove
Unexpected system instability when using hardware accelerators in virtualized environments

Detection Strategies

Monitor kernel logs for NULL pointer dereference errors in the UACCE subsystem
Implement kernel tracing on UACCE queue state transitions
Deploy crash analysis tools to identify race condition patterns in accelerator operations
Use kernel debugging features to track uacce_queue lifecycle events

Monitoring Recommendations

Enable kernel auditing for accelerator device operations
Configure system monitoring to alert on unexpected kernel panics or crashes
Implement log aggregation to correlate accelerator-related events across virtualized environments
Deploy runtime integrity monitoring to detect abnormal kernel behavior

How to Mitigate CVE-2026-23063

Immediate Actions Required

Update the Linux kernel to a patched version containing the fix commits
Consider disabling UACCE functionality if hardware accelerators are not required
Implement graceful shutdown procedures to avoid forced poweroff while accelerators are active
Monitor systems for signs of exploitation attempts

Patch Information

The vulnerability has been addressed through multiple kernel commits that introduce proper state management for UACCE queue release operations. The fix adds a stop_queue operation for the UACCE_CMD_PUT_Q command and includes state checks to prevent accessing freed pointers.

Patched commits are available:

Workarounds

Disable UACCE kernel module if hardware accelerators are not in use: modprobe -r uacce
Implement controlled shutdown procedures that ensure accelerator operations complete before system poweroff
Use virtualization configurations that gracefully handle accelerator device removal
Restrict local access to systems with UACCE-enabled accelerators to trusted users only

bash

# Configuration example
# Disable UACCE module at boot time
echo "blacklist uacce" >> /etc/modprobe.d/blacklist.conf

# Verify UACCE module status
lsmod | grep uacce

# If already loaded, remove the module (if no active users)
modprobe -r uacce