CVE-2026-23213: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23213 is a denial-of-service vulnerability in the Linux kernel's AMD power management (drm/amd/pm) driver, specifically during SMU (System Management Unit) Mode 1 reset operations. When an AMD ASIC undergoes a Mode 1 reset, it temporarily becomes inaccessible via PCIe; the driver failed to prevent MMIO register accesses during this window, allowing interrupt handlers or other driver threads to trigger uncompleted PCIe transactions, resulting in NMI panics or system hangs. Affected kernel versions include 5.9 through 6.12.69 and 6.13 through 6.18.9, as well as release candidates 6.19-rc1 through 6.19-rc4. The vulnerability was published on February 18, 2026, with patches added on March 18, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a race condition (CWE-362) in the drm/amd/pm driver: during SMU Mode 1 reset, the driver did not set the no_hw_access flag before other kernel threads or interrupt handlers could attempt MMIO register reads/writes to the now-offline AMD GPU. Without this guard, PCIe transactions to an inaccessible device go uncompleted, triggering Non-Maskable Interrupt (NMI) panics or indefinite system hangs. The fix sets no_hw_access = true immediately after triggering the reset and inserts an smp_mb() memory barrier to ensure the flag is globally visible across all CPU cores before the driver enters its sleep/wait state. Exploitation requires local access with low privileges (e.g., a user-space process that can trigger a GPU reset on an AMD GPU-equipped system) (Feedly, Kernel Patch 1).

Successful exploitation causes a denial of service — either an NMI kernel panic or a complete system hang — on Linux systems equipped with AMD GPUs. There is no confidentiality or integrity impact; only availability is affected. Systems running AMD GPU workloads in production environments (e.g., compute clusters, workstations, or servers with AMD discrete GPUs) are at risk of unexpected crashes during GPU reset operations, potentially requiring a hard reboot to recover (Feedly).

Update the Linux kernel to version 6.12.70 or later (for the 6.12.x stable series) or 6.18.10 or later (for the 6.13+ series). Three upstream patch commits address the issue: 0de604d, c1853eb, and cd7ff7f. Downstream distributions including Debian, Ubuntu, and Oracle Linux have issued updated kernel packages. Organizations should prioritize patching systems with AMD GPUs in production environments and test kernel updates in non-production environments first (Feedly, Debian Advisory, Ubuntu Advisory).

Downstream Linux distributions including Debian, Ubuntu, and Oracle Linux have issued kernel security advisories incorporating the fix. Coverage has appeared on Linux security aggregation sites and German Linux news outlet pro-linux.de. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability (Debian Advisory, Ubuntu Advisory, Oracle Advisory).