CVE-2026-23338 — Improper Validation of Specified Quantity in Input in Linux
Severity
5.3MEDIUM
No vectorEPSS
0.0%
top 94.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings
Userspace can either deliberately pass in the too small num_fences, or the
required number can legitimately grow between the two calls to the userq
wait ioctl. In both cases we do not want the emit the kernel warning
backtrace since nothing is wrong with the kernel and userspace will simply
get an errno reported back. So lets simply drop the WARN_ONs.…
Affected Packages3 packages
▶CVEListV5linux/linuxa292fdecd72834b3bec380baa5db1e69e7f70679 — 1753f5f81ab60a553287f9ee659a6ac363adf8d7+3
🔴Vulnerability Details
4OSV▶
CVE-2026-23338: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings Users↗2026-03-25
GHSA▶
GHSA-ggpq-p67g-h639: In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings
Use↗2026-03-25