Junglewise Threat Intelligence

CVE-2026-23424: Linux Kernel amdxdna buffer overflow in command payload validation

CVE-2026-23424 · Severity: high · CVSS 7.1 · Published 2026-04-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's AMD accelerator driver. This component manages specialized hardware used for high-performance computing tasks. An attacker with local access to the system could exploit this flaw to cause a system crash or potentially access sensitive information by providing a specially crafted command that exceeds the expected memory limits.

Technical details

A vulnerability exists in the amdxdna driver (specifically within drivers/accel/amdxdna/amdxdna_ctx.c) of the Linux kernel. The 'count' field in the command header, which determines the payload size, was not verified against the actual remaining buffer space. A local attacker with low privileges can provide a malicious command header where the payload count exceeds the allocated buffer size. This can result in an out-of-bounds read or write, leading to a denial of service (system crash) or information disclosure. The issue has been addressed by adding bounds checking to ensure the payload does not exceed the buffer's memory size.

Affected products

  • Linux Linux Kernel 6.14 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1 to 7.0-rc7

Timeline

  • 2026-04-03: disclosed
  • 2026-04-03: advisory
  • 2026-03-12: patched

References

Related threats