CVE-2026-23328: accel/amdxdna: Fix NULL pointer dereference of mgmt_chann

Q: What conditions are required to trigger the crash?

An attacker or local user needs local access with low privileges and must cause the AMD XDNA driver to encounter an unexpected firmware error in aie2_send_mgmt_msg_wait(). That error can leave mgmt_chann set to NULL, which may later be dereferenced during aie2_hw_stop().

Q: What is the likely impact?

The reported impact is availability loss: the NULL pointer dereference can crash or otherwise disrupt the affected kernel component. The CVSS vector indicates no confidentiality or integrity impact.

Q: What should be done if patching cannot happen immediately?

No workaround is provided in the available information. Prioritize applying the available kernel patch, particularly on systems where local low-privileged users can interact with the affected AMD XDNA functionality.

Published Mar 25, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Fix NULL pointer dereference of mgmtchann

mgmtchann may be set to NULL if the firmware returns an unexpected error in aie2sendmgmtmsgwait(). This can later lead to a NULL pointer dereference in aie2hwstop().

Fix this by introducing a dedicated helper to destroy mgmtchann and by adding proper NULL checks before accessing it.

Affected Software

10 affected components

Linux Linux kernel

Linux Linux kernel>=6.14.1<6.19.7

Linux Linux kernel=6.14

Linux Linux kernel=7.0-rc1

Linux Linux kernel=7.0-rc2

Linux Linux kernel=7.0-rc3

Linux Linux kernel=7.0-rc4

Linux Linux kernel=7.0-rc5

Linux Linux kernel=7.0-rc6

Linux Linux kernel=7.0-rc7

Remediation

Patch Available

https://git.kernel.org/stable/c/032ca7a9059c4ba6c329e0f1b442dab54dd9c3e5

Patch Available

https://git.kernel.org/stable/c/6270ee26e1edd862ea17e3eba148ca8fb2c99dc9

Event History

Mar 25, 2026

CVE Published

via MITRE·10:27 AM

Data Sourced

via MITRE·10:27 AM

Description

Data Sourced

via NVD·11:16 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What conditions are required to trigger the crash?

An attacker or local user needs local access with low privileges and must cause the AMD XDNA driver to encounter an unexpected firmware error in aie2_send_mgmt_msg_wait(). That error can leave mgmt_chann set to NULL, which may later be dereferenced during aie2_hw_stop().

What is the likely impact?

The reported impact is availability loss: the NULL pointer dereference can crash or otherwise disrupt the affected kernel component. The CVSS vector indicates no confidentiality or integrity impact.

What should be done if patching cannot happen immediately?

No workaround is provided in the available information. Prioritize applying the available kernel patch, particularly on systems where local low-privileged users can interact with the affected AMD XDNA functionality.

CVE-2026-23328: accel/amdxdna: Fix NULL pointer dereference of mgmt_chann

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What conditions are required to trigger the crash?

What is the likely impact?

What should be done if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the crash?

What is the likely impact?

What should be done if patching cannot happen immediately?