CVE-2026-23328: 
Chainguard vulnerability analysis and mitigation

CVE-2026-23328 is a NULL pointer dereference vulnerability in the Linux kernel's accel/amdxdna driver affecting systems with AMD XDNA hardware acceleration. The flaw exists because mgmt_chann may be set to NULL when the firmware returns an unexpected error in aie2_send_mgmt_msg_wait(), which can subsequently trigger a NULL pointer dereference in aie2_hw_stop(), causing a kernel panic. Affected versions include Linux kernel 6.14 through 6.19.6 and release candidates for 7.0 (rc1–rc7). It was published on March 25, 2026, with patches released in April 2026. The CVSS v3.1 base score is 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In the accel/amdxdna driver, the mgmt_chann pointer is not guaranteed to be non-NULL after a firmware error in aie2_send_mgmt_msg_wait(); if the firmware returns an unexpected error, mgmt_chann is set to NULL. A subsequent call to aie2_hw_stop() dereferences this pointer without a NULL check, triggering a kernel panic. The fix introduces a dedicated helper function to destroy mgmt_chann and adds proper NULL guards before any access, addressed in kernel commits 032ca7a9059c and 6270ee26e1ed (Red Hat Bugzilla, Feedly).

Successful exploitation results in a kernel panic (denial of service), crashing the affected system. The vulnerability has no impact on confidentiality or integrity — only availability is affected. Exploitation is limited to systems equipped with AMD XDNA hardware acceleration devices that load the vulnerable accel/amdxdna driver, and does not enable lateral movement or data exfiltration (Red Hat Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability requires local access with low privileges and has low attack complexity with no user interaction needed. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

Apply the upstream Linux kernel patches included in version 6.19.7 or later (for the 6.14.1–6.19.6 range), or apply commits 032ca7a9059c4ba6c329e0f1b442dab54dd9c3e5 and 6270ee26e1edd862ea17e3eba148ca8fb2c99dc9 from the stable kernel branch. As a workaround, restrict local access to systems running vulnerable kernel versions, particularly those with AMD XDNA hardware. Monitor for unexpected kernel panic events referencing the amdxdna driver or aie2_hw_stop() (Red Hat Bugzilla, Feedly).