CVE-2026-23358: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23358 is a vulnerability in the Linux kernel's drm/amdgpu driver related to improper error handling during PCIe slot reset. When a device fails to recover after a slot reset, the error handling path may access an uninitialized hive pointer and an uninitialized list structure, and may also fail to release the reset domain lock acquired during the error_detected callback. The vulnerability affects Linux kernel versions 6.16 through 6.18.16, 6.19 through 6.19.6, and pre-release 7.0-rc1 through 7.0-rc7. It was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-824 (Access of Uninitialized Pointer) and CWE-908 (Use of Uninitialized Resource). In the amdgpu driver's slot reset function, if the device does not recover successfully, execution jumps to an out error-handling label. At this point, the hive pointer and associated list have not been properly initialized, meaning subsequent logic that dereferences the pointer or iterates the list operates on undefined memory. Additionally, the reset domain lock acquired during the error_detected callback is not released in this error path, potentially causing lock contention or deadlocks. The fix, cherry-picked from upstream commit bb71362182e59caa227e4192da5a612b09349696, properly initializes the hive pointer and list before use and ensures the lock is released (Red Hat Bugzilla).

Exploitation of this vulnerability is limited to local attackers with low privileges on systems equipped with AMD GPUs. A failed device reset can trigger memory corruption or system instability due to uninitialized pointer/list access, and the unreleased reset domain lock can cause system hangs or denial of service during subsequent error recovery operations. There is no impact on confidentiality or integrity; the primary risk is availability loss on affected AMD GPU systems (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), reflecting a very low probability of exploitation in the near term. Exploitation requires local access and the ability to trigger a GPU device reset failure scenario (Red Hat Advisory).

Patches are available in Linux kernel versions 6.18.17, 6.19.7, and 7.0-rc2 or later, via commits 73e8bdf14248136459753252a438177df7ed8c7c, baf4e7968911635eb816870af0ea587ac1457052, and b57c4ec98c17789136a4db948aec6daadceb5024. Users should update their kernel to a patched version as the primary remediation. For systems that cannot be immediately patched, monitoring for unusual GPU driver behavior, system hangs, or error recovery failures involving AMD GPUs is recommended as a temporary measure (Red Hat Advisory, Red Hat Bugzilla).