What is the CVSS score of CVE-2026-23280?

CVE-2026-23280 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-23280?

Yes, a patch is available for CVE-2026-23280. Update the affected software to the latest version immediately.

Linux CVE-2026-23280

EUVD-2026-15200 HIGH

2026-03-25 Linux

GHSA-qcvf-8537-hx8x

Linux Buffer Overflow

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 25, 2026 - 10:45 euvd

EUVD-2026-15200

Analysis Generated

Mar 25, 2026 - 10:45 vuln.today

CVE Published

Mar 25, 2026 - 10:26 nvd

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Prevent ubuf size overflow

The ubuf size calculation may overflow, resulting in an undersized allocation and possible memory corruption.

Use check_add_overflow() helpers to validate the size calculation before allocation.

AnalysisAI

A size calculation overflow vulnerability exists in the Linux kernel's accel/amdxdna driver that can result in undersized buffer allocations and potential memory corruption. The vulnerability affects Linux kernel versions across multiple branches where the AMD XDNA accelerator driver is compiled. An attacker with local access could exploit this to trigger memory corruption, potentially leading to denial of service or privilege escalation, though exploitation complexity and attack surface requirements remain moderate.

Technical ContextAI

The vulnerability resides in the AMD XDNA accelerator (accel/amdxdna) driver within the Linux kernel, which manages hardware acceleration for AMD's XDNA devices. The root cause is an integer overflow in ubuf (user buffer) size calculation that occurs before memory allocation. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, indicating all Linux kernel versions are potentially affected depending on build configuration. The vulnerability class relates to insufficient input validation during arithmetic operations (CWE-190: Integer Overflow or Wraparound), where unchecked size calculations bypass intended allocation limits. The fix implements check_add_overflow() helper functions to validate arithmetic operations before allocation, preventing malicious or malformed input from causing integer wraparound conditions.

RemediationAI

Apply the latest Linux kernel patch by upgrading to a kernel version that includes the overflow check fix, available in stable branches via https://git.kernel.org/stable/c/1500b31db94374a6669e73ce94d6f71cf8e85e06 and related commits. For distributions, check with your Linux vendor (Red Hat, Canonical, SUSE, etc.) for backported kernel updates addressing CVE-2026-23280. If immediate patching is not feasible, disable or unload the amdxdna driver module using modprobe -r amdxdna if the hardware is not in active use, and restrict access to device ioctl interfaces through SELinux or AppArmor policies. Prioritize patching for systems running AMD XDNA accelerators in production environments or shared compute platforms.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2017-11882 HIGH POC

7.8

CVE-2010-3333 HIGH POC

7.8

Vendor StatusVendor

Debian

linux

Release	Status	Fixed Version	Urgency
bullseye	not-affected	-	-
bullseye (security)	fixed	5.10.251-1	-
bookworm	not-affected	-	-
bookworm (security)	fixed	6.1.164-1	-
trixie	not-affected	-	-
trixie (security)	fixed	6.12.74-2	-
forky, sid	fixed	6.19.8-1	-
(unstable)	fixed	6.19.8-1	-

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

CVE-2026-23280 vulnerability details – vuln.today

Back

Linux CVE-2026-23280

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

Debian

SUSE

Share

External POC / Exploit Code