CVE-2026-23358: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23358 Overview

A vulnerability has been identified in the Linux kernel's AMDGPU graphics driver related to improper error handling during PCIe slot reset operations. When a device fails to recover after a slot reset is triggered, the error handling path may access an uninitialized hive pointer and uninitialized list structure, potentially leading to system instability or undefined behavior.

Critical Impact
This vulnerability could result in kernel memory corruption or system crashes when PCIe slot reset fails on AMD GPU devices, affecting system stability and potentially exposing sensitive kernel memory.

Affected Products

Linux kernel with AMDGPU DRM driver enabled
Systems with AMD GPU hardware using PCIe slot reset functionality
Affected kernel versions prior to the security patch

Discovery Timeline

2026-03-25 - CVE CVE-2026-23358 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23358

Vulnerability Analysis

The vulnerability exists in the AMDGPU Direct Rendering Manager (DRM) driver's slot reset error handling code. When a PCIe slot reset operation is initiated but the AMD GPU device fails to recover, the code jumps to an error handling label (out). At this point, critical data structures—specifically the hive pointer and associated list structures—may not have been properly initialized.

The problematic flow occurs when the error_detected callback acquires the reset domain lock, but if the device recovery fails before the hive and list are initialized, the error handling path attempts to make decisions based on these uninitialized values. This can lead to dereferencing uninitialized pointers or iterating over uninitialized list structures, resulting in undefined behavior.

The fix ensures that the list and hive pointer are properly initialized early in the function, guaranteeing that regardless of where the error occurs, the cleanup path will operate on valid data structures. This also ensures the reset domain lock acquired during the error_detected callback is properly released.

Root Cause

The root cause is the use of uninitialized memory in error handling paths. The hive pointer and associated list structures were not initialized before potentially being accessed in the error cleanup code. This represents a classic uninitialized memory use vulnerability where error paths were not properly accounting for all possible failure scenarios during slot reset operations.

Attack Vector

This vulnerability is triggered through a failure condition during PCIe slot reset on AMD GPU devices. While the attack vector is not fully characterized, exploitation would likely require:

A system with AMD GPU hardware using the AMDGPU driver
A condition that causes PCIe slot reset to be triggered (hardware fault, power management event, or potentially a malicious driver interaction)
A failure of the device to recover from the slot reset operation

The vulnerability is primarily a stability and reliability issue, though accessing uninitialized memory could potentially leak sensitive kernel information or cause memory corruption depending on the memory state at the time of access.

Detection Methods for CVE-2026-23358

Indicators of Compromise

Kernel panic or oops messages referencing drm/amdgpu or slot reset functions
System crashes or hangs during GPU error recovery operations
Kernel log entries indicating uninitialized list access or null pointer dereference in AMDGPU code
Unexpected GPU reset failures followed by system instability

Detection Strategies

Monitor kernel logs for AMDGPU-related error messages, particularly those involving slot reset or error recovery
Implement kernel crash dump analysis to identify stack traces pointing to AMDGPU slot reset handling code
Use kernel debugging tools like KASAN (Kernel Address Sanitizer) to detect uninitialized memory access
Deploy endpoint monitoring solutions that can detect kernel-level anomalies

Monitoring Recommendations

Enable verbose kernel logging for DRM subsystem events
Configure automatic kernel crash dump collection for post-incident analysis
Monitor system stability metrics on machines with AMD GPUs, particularly after power events or hardware errors
Implement automated alerting for kernel oops events related to graphics drivers

How to Mitigate CVE-2026-23358

Immediate Actions Required

Apply the latest kernel patches that address this vulnerability
If patches are not immediately available, consider temporarily disabling PCIe slot reset functionality if operationally feasible
Monitor affected systems closely for stability issues
Ensure kernel crash dump collection is enabled for forensic analysis if exploitation occurs

Patch Information

The vulnerability has been resolved through kernel patches that properly initialize the hive pointer and list structures before any code path that might access them. The fix was cherry-picked from commit bb71362182e59caa227e4192da5a612b09349696.

The following stable kernel patches are available:

Workarounds

Update to a patched kernel version as the primary remediation
On systems where immediate patching is not possible, consider disabling AMDGPU driver if the hardware is not critical for operations
Implement additional system monitoring to quickly detect and respond to any kernel instability
For virtualized environments, ensure host kernels are patched even if guest systems are the primary concern

bash

# Check current kernel version
uname -r

# Update kernel on Debian/Ubuntu systems
sudo apt update && sudo apt upgrade linux-image-generic

# Update kernel on RHEL/CentOS systems
sudo yum update kernel

# Verify AMDGPU driver is loaded (to confirm affected)
lsmod | grep amdgpu