CVE-2026-23264: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23264 is a Linux kernel regression in the AMD GPU driver (drm/amd) that causes system crashes on machines with multiple AMD GPUs where only some support ASPM (Active State Power Management). The vulnerability arises from commit 7294863a6f01248d72b61d38478978d638641bee being erroneously reapplied after it had already been removed by commit 0ab5d711ec74 (drm/amd: Refactor amdgpu_aspm to be evaluated per device). Affected kernel versions span from 5.15.54 through multiple stable branches prior to the fixed releases. It was disclosed on March 18, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is a code regression (CWE-672: Operation on a Resource after Expiration or Release / regression-class defect) in the drm/amd subsystem of the Linux kernel. Commit 7294863a6f01248d72b61d38478978d638641bee, which checks ASPM enablement from the PCIe subsystem, was reintroduced after the per-device ASPM evaluation refactoring (amdgpu_aspm) had already removed it. On systems with two AMD GPUs where only one supports ASPM, the conflicting ASPM check logic triggers kernel panics that are very difficult to diagnose. The attack vector is local (requiring low privileges), and the precondition is a system running a vulnerable kernel version with at least two AMD GPUs of differing ASPM capabilities (Red Hat CVE, Feedly).

The primary impact is a high availability loss: affected systems experience hard-to-debug kernel crashes and instability, effectively causing denial of service. There is no confidentiality or integrity impact, as the vulnerability does not expose data or allow unauthorized modification. The scope is limited to systems running vulnerable Linux kernel versions (5.15.54 through the unpatched stable branches) with mixed-ASPM multi-AMD-GPU configurations (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2026-23264. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting very low probability of exploitation. The issue is a hardware-configuration-dependent kernel regression rather than a remotely triggerable security flaw, further limiting its exploitability (Feedly).

Patches are available in the following Linux kernel stable releases: 6.1.163+, 6.6.124+, 6.12.70+, 6.18.10+, and 6.19. Administrators should upgrade to one of these patched versions as the primary remediation. As a temporary workaround on unpatched systems with multiple AMD GPUs, consider disabling one GPU or ensuring uniform ASPM capability across GPUs to avoid triggering the conflicting code path. SUSE has also released security updates (SUSE-SU-2026:2217-1 and SUSE-SU-2026:2238-1) addressing this issue (Red Hat CVE, SUSE Advisory 1, SUSE Advisory 2).