CVE-2026-23469: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23469 is a race condition vulnerability in the Linux kernel's DRM Imagination GPU driver (drm/imagination) where the runtime PM suspend callback does not synchronize with IRQ handlers executing concurrently on other CPU cores. This timing issue can cause the IRQ handler to access GPU registers after the GPU has been suspended, resulting in kernel panics. Affected Linux kernel versions range from 6.8 up to (excluding) 6.18.20, from 6.19 up to (excluding) 6.19.10, and release candidates 7.0-rc1 through 7.0-rc4. It was published on April 3, 2026, with a CVSS v3.1 base score of 4.7 (Medium) (GitHub Advisory).

The root cause is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / Race Condition). The runtime PM suspend callback in the drm/imagination driver initiates GPU power-down without calling synchronize_irq(), leaving a window during which a threaded IRQ handler (pvr_device_irq_thread_handler) on another CPU core may attempt to read GPU registers (e.g., via pvr_riscv_irq_pending) that are no longer accessible. Additionally, the threaded IRQ handler incorrectly contained runtime PM resume/put calls, which — combined with the fix — would have caused a deadlock: synchronize_irq() holds the device power lock from the suspend callback while the resume path attempts to acquire the same lock. The fix removes those calls from the IRQ handler and adds synchronize_irq() to the power-off sequence (GitHub Advisory).

Successful triggering of this race condition results in an asynchronous SError interrupt and an unrecoverable kernel panic, causing a full system crash. There is no confidentiality or integrity impact; the sole consequence is a high availability impact due to system crashes during GPU power management transitions. This is particularly relevant on embedded platforms using Imagination GPU hardware, such as the Texas Instruments AM68 SK, where GPU runtime power management is actively exercised (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The vulnerability requires local access with low privileges (e.g., a process that can trigger GPU power transitions) and high attack complexity due to the timing-dependent nature of the race condition. The EPSS score is approximately 0.017% (2nd percentile), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

• Logs: Kernel log entries containing SError Interrupt on CPU with code 0x00000000bf000000, Kernel panic - not syncing: Asynchronous SError Interrupt, or call traces referencing pvr_riscv_irq_pending, pvr_device_irq_thread_handler, or irq_thread_fn.
• Process: Unexpected termination or crash of the irq/234-gpu kernel thread (or similarly named GPU IRQ thread) during GPU suspend/resume cycles.
• System Behavior: Repeated system reboots or kernel oops events correlated with GPU power management activity (e.g., display sleep/wake or GPU idle transitions) on platforms using Imagination GPU hardware.

Update the Linux kernel to a patched version: 6.18.20 or later for the 6.18.x stable series, or 6.19.10 or later for the 6.19.x series. Patches have been committed to the stable kernel tree at multiple commits (e.g., 2d7f05c, 772f365, 8e0c15e, 5025745). There is no documented configuration-based workaround; the recommended action is to apply the upstream kernel patch. Organizations running embedded Linux on Imagination GPU platforms (e.g., TI AM68 SK) should prioritize this update (GitHub Advisory).