CVE-2026-23295: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23295 is a deadlock vulnerability in the Linux kernel's AMD XDNA accelerator driver (accel/amdxdna) affecting the suspend and resume power management path. When an application issues a query IOCTL while auto-suspend is running, a deadlock occurs because the query path holds dev_lock and then calls pm_runtime_resume_and_get(), while the suspend callback simultaneously attempts to acquire dev_lock. The vulnerability affects Linux kernel versions 6.19 through 6.19.6 and 7.0-rc1, and was disclosed on March 25, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper resource locking (CWE-413, CWE-667) in the accel/amdxdna driver. The query IOCTL handler acquires dev_lock and then calls pm_runtime_resume_and_get(), which blocks waiting for an in-progress auto-suspend to complete; the suspend callback, in turn, attempts to acquire dev_lock, creating a circular wait (classic ABBA deadlock). Exploitation requires local access with low privileges and the ability to issue IOCTL calls to the AMD XDNA accelerator device while the system's power management runtime is actively suspending the device. The fix releases dev_lock before calling pm_runtime_resume_and_get() and reacquires it afterward, and also acquires dev_lock in the resume callback for consistent locking (Red Hat Bugzilla, Red Hat Advisory).

Successful triggering of this vulnerability results in a denial-of-service condition: the AMD XDNA accelerator driver freezes, potentially causing the affected system to hang or become unresponsive. There is no confidentiality or integrity impact — only availability is affected. The impact is localized to systems equipped with AMD XDNA accelerators running affected Linux kernel versions, and there is no known path for lateral movement or data exfiltration (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access and a specific hardware configuration (AMD XDNA accelerator), significantly limiting the attack surface (Red Hat Advisory).

Update the Linux kernel to version 6.19.7 or later (for the 6.19 branch) or 7.0-rc2 or later (for the 7.0 branch), which include the upstream fix. Patches are available via the stable kernel tree. Systems that do not use AMD XDNA accelerators are not affected and require no action. As a temporary workaround, disabling runtime power management (auto-suspend) for the AMD XDNA device may prevent the deadlock condition until a patched kernel can be deployed (Red Hat Bugzilla, Red Hat Advisory).