Summaryinfo

A vulnerability has been found in Linux Kernel up to 6.19.6/7.0-rc1 and classified as critical. Affected is the function pm_runtime_resume_and_get of the component amdxdna. Performing a manipulation results in deadlock. This vulnerability is known as CVE-2026-23295. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.19.6/7.0-rc1. This affects the function pm_runtime_resume_and_get of the component amdxdna. The manipulation with an unknown input leads to a deadlock vulnerability. CWE is classifying the issue as CWE-833. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. This is going to have an impact on availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix dead lock for suspend and resume When an application issues a query IOCTL while auto suspend is running, a deadlock can occur. The query path holds dev_lock and then calls pm_runtime_resume_and_get(), which waits for the ongoing suspend to complete. Meanwhile, the suspend callback attempts to acquire dev_lock and blocks, resulting in a deadlock. Fix this by releasing dev_lock before calling pm_runtime_resume_and_get() and reacquiring it after the call completes. Also acquire dev_lock in the resume callback to keep the locking consistent.

It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-23295 since 01/13/2026. The exploitability is told to be difficult. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 304112 (Linux Distros Unpatched Vulnerability : CVE-2026-23295), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.19.7 or 7.0-rc2 eliminates this vulnerability. Applying the patch ac24537478dd8eb2fd3984b4652bb19461e5e74c/1aa82181a3c285c7351523d587f7981ae4c015c8 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (304112) and CERT Bund (WID-SEC-2026-0861). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3
• 6.19.4
• 6.19.5
• 6.19.6
• 7.0-rc1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion