CVE-2026-23288

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix out-of-bounds memset in command slot handling The remaining space in a command slot may be smaller than the size of the command header. Clearing the command header with memset() before verifying the available slot space can result in an out-of-bounds write and memory corruption. Fix this by moving the memset() call after the size validation.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/1110a949675ebd56b3f0286e664ea543f745801c	Patch
https://git.kernel.org/stable/c/cca770d710d5e03bc814af585cd6975eb6d74074	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::

History

No history.

Information

Published : 2026-03-25 11:16

Updated : 2026-06-17 10:21

NVD link : CVE-2026-23288

Mitre link : CVE-2026-23288

CVE.ORG link : CVE-2026-23288

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-23288", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "13ae1a6000f7d8b09478e3128e87d45e89c7282f", "lessThan": "cca770d710d5e03bc814af585cd6975eb6d74074", "versionType": "git"}, {"status": "affected", "version": "3d32eb7a5ecff92d83a5fd34c45c171c17d3d5d0", "lessThan": "1110a949675ebd56b3f0286e664ea543f745801c", "versionType": "git"}], "programFiles": ["drivers/accel/amdxdna/aie2_message.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.19.4", "lessThan": "6.19.7", "versionType": "semver"}], "programFiles": ["drivers/accel/amdxdna/aie2_message.c"], "defaultStatus": "unaffected"}]}], "published": "2026-03-25T11:16:23.767", "references": [{"url": "https://git.kernel.org/stable/c/1110a949675ebd56b3f0286e664ea543f745801c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cca770d710d5e03bc814af585cd6975eb6d74074", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Fix out-of-bounds memset in command slot handling\n\nThe remaining space in a command slot may be smaller than the size of\nthe command header. Clearing the command header with memset() before\nverifying the available slot space can result in an out-of-bounds write\nand memory corruption.\n\nFix this by moving the memset() call after the size validation."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\naccel/amdxdna: Correcci\u00f3n de memset fuera de l\u00edmites en el manejo de ranuras de comando\n\nEl espacio restante en una ranura de comando puede ser menor que el tama\u00f1o del encabezado de comando. Borrar el encabezado de comando con memset() antes de verificar el espacio de ranura disponible puede resultar en una escritura fuera de l\u00edmites y corrupci\u00f3n de memoria.\n\nEsto se corrige moviendo la llamada a memset() despu\u00e9s de la validaci\u00f3n del tama\u00f1o."}], "lastModified": "2026-06-17T10:21:15.733", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EABFC675-2A5E-4569-92F7-1E8942DA0683", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}