CVE-2026-23051: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23051 is a null pointer dereference vulnerability in the Linux kernel's drm/amdgpu subsystem. It occurs when a DRM (Direct Rendering Manager) driver does not support atomic modesetting, causing the code to incorrectly reference plane->state->fb instead of plane->fb, leading to a kernel panic. The vulnerability was published on February 4, 2026, and affects Linux kernel versions prior to the patches applied in the 6.18.7 and 6.19-rc6 release lines. It carries an estimated CVSS severity of Medium, with an EPSS score of approximately 0.018% (Feedly, EUVD).

The root cause is a null pointer dereference (CWE-476) in the drm/amdgpu driver within the Linux kernel. When a driver does not support atomic modesetting, the framebuffer (fb) should be retrieved from plane->fb; however, the vulnerable code path incorrectly accesses plane->state->fb, which is NULL in non-atomic contexts, triggering a kernel panic. The fix, cherry-picked from upstream commit 2f2a72de673513247cd6fae14e53f6c40c5841ef, corrects the framebuffer pointer selection based on driver capability. Patches are available at stable kernel commits a1aedf4053af7dad3772b94b057a7d1f5473055f and 9cb6278b44c38899961b36d303d7b18b38be2a6e (Feedly, EUVD).

Successful triggering of this vulnerability causes a kernel panic (system crash), resulting in a denial of service on affected Linux systems running the amdgpu DRM driver in a non-atomic configuration. There is no evidence of confidentiality or integrity impact, as the vulnerability leads to a null pointer dereference that crashes the kernel rather than enabling code execution or data exfiltration. The scope is limited to systems with AMD GPUs using the amdgpu driver where atomic modesetting is not supported (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2026-23051. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Nessus plugin 297937 (Tenable, Feedly).

Apply the upstream Linux kernel patches that correct the framebuffer pointer logic in the drm/amdgpu driver. Fixed versions include Linux kernel 6.18.7 and 6.19-rc6, with patches at stable commits a1aedf4053af7dad3772b94b057a7d1f5473055f and 9cb6278b44c38899961b36d303d7b18b38be2a6e. Users of affected distributions should apply vendor-provided kernel updates as they become available. As a temporary workaround, disabling or avoiding non-atomic DRM configurations on amdgpu hardware may reduce exposure, though upgrading the kernel is the recommended remediation (EUVD, Feedly).