CVE-2026-23063 Details
Description
In the Linux kernel, the following vulnerability has been resolved: uacce: ensure safe queue release with state management Directly calling `put_queue` carries risks since it cannot guarantee that resources of `uacce_queue` have been fully released beforehand. So adding a `stop_queue` operation for the UACCE_CMD_PUT_Q command and leaving the `put_queue` operation to the final resource release ensures safety. Queue states are defined as follows: - UACCE_Q_ZOMBIE: Initial state - UACCE_Q_INIT: After opening `uacce` - UACCE_Q_STARTED: After `start` is issued via `ioctl` When executing `poweroff -f` in virt while accelerator are still working, `uacce_fops_release` and `uacce_remove` may execute concurrently. This can cause `uacce_put_queue` within `uacce_fops_release` to access a NULL `ops` pointer. Therefore, add state checks to prevent accessing freed pointers.
A vulnerability in the Linux kernel's UACCE (User Accelerator) queue management has been addressed. The issue arose because the `put_queue` function could be called directly without ensuring that the resources of the `uacce_queue` were fully released. This lack of proper state management could lead to accessing a NULL pointer, causing potential instability or crashes. The vulnerability was particularly relevant when the `poweroff -f` command was executed in a virtual environment while accelerators were still active, allowing concurrent execution of queue release operations that could interfere with each other.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for upgrading the kernel can be found in the official Linux kernel documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/26c08dabe5475d99a13f353d8dd70e518de45663 | kernel.org | Patch |
| https://git.kernel.org/stable/c/336fb41a186e7c0415ae94fec9e23d1f04b87483 | kernel.org | Patch |
| https://git.kernel.org/stable/c/43f233eb6e7b9d88536881a9bc43726d0e34800d | kernel.org | Patch |
| https://git.kernel.org/stable/c/47634d70073890c9c37e39ab4ff93d4b585b028a | kernel.org | Patch |
| https://git.kernel.org/stable/c/8b57bf1d3b1db692f34bce694a03e41be79f6016 | kernel.org | Patch |
| https://git.kernel.org/stable/c/92e4f11e29b98ef424ff72d6371acac03e5d973c | kernel.org | Patch |
| https://git.kernel.org/stable/c/b457abeb5d962db88aaf60e249402fd3073dbfab | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.7, < 5.10.249 >= 5.11, < 5.15.199 >= 5.16, < 6.1.162 >= 6.2, < 6.6.122 >= 6.7, < 6.12.68 >= 6.13, < 6.18.8 6.19 rc1 6.19 rc2 6.19 rc3 6.19 rc4 6.19 rc5 6.19 rc6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Mar 13, 2026 | Initial Analysis | [email protected] |
| Feb 6, 2026 | CVE Modified | kernel.org |
| Feb 4, 2026 | New CVE Received | kernel.org |