CVE-2026-23264 in Linux
Summary
by MITRE • 03/18/2026
In the Linux kernel, the following vulnerability has been resolved:
Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"
This reverts commit 7294863a6f01248d72b61d38478978d638641bee.
This commit was erroneously applied again after commit 0ab5d711ec74 ("drm/amd: Refactor `amdgpu_aspm` to be evaluated per device") removed it, leading to very hard to debug crashes, when used with a system with two AMD GPUs of which only one supports ASPM.
(cherry picked from commit 97a9689300eb2b393ba5efc17c8e5db835917080)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/01/2026
The vulnerability described in CVE-2026-23264 represents a critical regression in the Linux kernel's graphics driver subsystem that affects AMD GPU implementations. This issue stems from an erroneous reapplication of a commit that was originally intended to address PCIe power management concerns but was subsequently removed due to architectural changes. The problem manifests specifically within the drm/amd driver component where the ASPM (Active State Power Management) checking mechanism was reintroduced inappropriately, creating a fundamental conflict with the newer device-specific power management refactoring that occurred in commit 0ab5d711ec74. The technical flaw lies in the improper handling of PCIe power management states across multiple GPU configurations, particularly when systems contain two AMD graphics processors where only one supports ASPM functionality.
The operational impact of this vulnerability is severe and manifests as extremely difficult-to-debug system crashes that occur in multi-GPU configurations. When a system contains two AMD GPUs with differing ASPM support capabilities, the erroneous reapplication of the ASPM checking logic creates race conditions and memory access violations within the graphics driver subsystem. The crash patterns are particularly challenging to diagnose because they depend on the specific combination of GPU models and their power management capabilities, making this vulnerability appear intermittent and unpredictable to system administrators. The instability affects the entire graphics subsystem and can lead to complete system hangs or forced reboots, severely impacting productivity in environments relying on multi-GPU configurations for high-performance computing or graphics-intensive workloads.
The root cause of this vulnerability aligns with CWE-843, which addresses "Access of Resource Using Incompatible Type" and specifically relates to improper handling of PCIe power management states in a multi-device environment. This flaw also maps to ATT&CK technique T1547.001, "Registry Run Keys / Startup Folder," as the problematic commit reapplication affects system-level driver initialization and runtime behavior. The vulnerability demonstrates poor software engineering practices in commit management and version control, where a commit that was properly removed due to architectural conflicts was erroneously reapplied without proper validation of the system state. The reversion of commit 7294863a6f01248d72b61d38478978d638641bee addresses this by restoring the proper device-specific power management evaluation that was lost when the erroneous commit was reapplied. The fix specifically targets the drm/amd driver's amdgpu_aspm evaluation mechanism, ensuring that power management decisions are properly evaluated on a per-device basis rather than attempting global ASPM checks that conflict with modern driver architecture.
Recommended mitigations include immediate deployment of the kernel patch that reverts the problematic commit and ensures proper device-specific ASPM evaluation. System administrators should verify that their multi-GPU configurations are properly tested after applying the patch, particularly focusing on the interaction between different GPU models that have varying ASPM support capabilities. Organizations running critical workloads involving multiple AMD GPUs should conduct thorough regression testing to ensure stability. Additionally, monitoring systems should be configured to detect unusual GPU driver behavior or system crashes that might indicate the presence of this vulnerability before patch deployment, as the symptoms can be quite subtle and system-dependent. The fix also emphasizes the importance of proper commit management practices in kernel development, where architectural changes must be carefully coordinated to prevent such regressions from being introduced into stable releases.