CVE-2026-23338

Vulnerability

CVE-2026-23338 is a vulnerability in the Linux kernel's AMDGPU driver, specifically in the userq (user queue) wait ioctl. The issue arises from the use of WARN_ON macros that could be triggered by userspace when the number of fences passed to the ioctl is too small. This can happen either deliberately or because the required number of fences legitimately grows between two calls to the ioctl [1].

Exploitation

An attacker with local access and the ability to interact with the AMDGPU device can exploit this by passing a num_fences value that is smaller than needed. No special privileges beyond normal user access to the DRM device are required. The attack surface is local, as it involves the kernel's DRM subsystem [1].

Impact

Triggering the WARN_ON causes a kernel warning backtrace to be printed to the kernel log, which can be used to generate noise or potentially aid in denial-of-service scenarios. However, the fix notes that nothing is wrong with the kernel itself, and userspace simply receives an errno. The impact is limited to unnecessary kernel log spam and potential distraction for system administrators [1].

Mitigation

The fix removes the WARN_ON macros, preventing userspace from trivially triggering kernel warnings. The vulnerability is patched in the Linux kernel stable tree. Users should update to a kernel version containing the commit 2c333ea579de6cc20ea7bc50e9595ef72863e65c or later [1].