CVE-2026-23424

Root

Cause The vulnerability resides in the Linux kernel's accel/amdxdna driver. The command header contains a count field that specifies the payload size. The driver failed to validate that this payload does not exceed the remaining buffer space, leading to a potential out-of-bounds access [1].

Exploitation

An attacker with local access to the accelerator device can craft a command with an artificially large count field, causing the driver to read or write beyond the allocated buffer. No special privileges beyond the ability to interact with the device are required [1].

Impact

Successfully exploiting this vulnerability can result in memory corruption, potentially leading to system instability, information disclosure, or arbitrary code execution in kernel context.

Mitigation

The issue has been fixed in the Linux kernel by adding a validation check that ensures the payload size does not exceed the buffer space [1]. Administrators should apply the latest stable kernel updates to remediate this vulnerability.