SB20260325167 - Empty Exception Block in Linux kernel accel amdxdna driver

Description

This security bulletin contains information about 1 vulnerability.

1) Empty Exception Block (CVE-ID: CVE-2026-23295)

CWE-ID: CWE-1069 - Empty Exception Block

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in the AMDXDNA driver when handling IOCTL queries during device suspend and resume operations. A local user can issue a specially crafted IOCTL request during an auto-suspend cycle to trigger a deadlock, resulting in a denial of service.

The system must be in the process of suspending or resuming, and the attacker must have access to the device interface.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1aa82181a3c285c7351523d587f7981ae4c015c8
• https://git.kernel.org/stable/c/ac24537478dd8eb2fd3984b4652bb19461e5e74c