What is the CVSS score of CVE-2026-23338?

CVE-2026-23338 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-23338?

Yes, a public proof-of-concept exploit is available for CVE-2026-23338. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-23338?

Yes, a patch is available for CVE-2026-23338. Update the affected software to the latest version immediately.

Linux CVE-2026-23338

EUVD-2026-15304 MEDIUM

2026-03-25 Linux

Information Disclosure Linux Red Hat

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SUSE

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 21:27 NVD

5.5 (MEDIUM)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 25, 2026 - 15:41 vuln.today

Public exploit code

EUVD ID Assigned

Mar 25, 2026 - 10:45 euvd

EUVD-2026-15304

Analysis Generated

Mar 25, 2026 - 10:45 vuln.today

CVE Published

Mar 25, 2026 - 10:27 nvd

N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings

Userspace can either deliberately pass in the too small num_fences, or the required number can legitimately grow between the two calls to the userq wait ioctl. In both cases we do not want the emit the kernel warning backtrace since nothing is wrong with the kernel and userspace will simply get an errno reported back. So lets simply drop the WARN_ONs.

(cherry picked from commit 2c333ea579de6cc20ea7bc50e9595ef72863e65c)

AnalysisAI

This vulnerability allows userspace applications to trivially trigger kernel warning backtraces in the AMD GPU (amdgpu) driver's user queue (userq) implementation by passing intentionally small num_fences values or exploiting legitimate growth between successive ioctl calls. While not a traditional security vulnerability enabling code execution or data theft, it constitutes an information disclosure issue through kernel log pollution and denial-of-service potential via warning spam. The Linux kernel across all versions utilizing the affected amdgpu userq code path is impacted, though the actual attack surface is limited to systems with AMD GPUs and unprivileged users with access to the amdgpu device interface.

Technical ContextAI

The vulnerability resides in the AMD GPU driver's user queue (userq) functionality within the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically in the amdgpu driver component (affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*). The root cause is classified under information disclosure and improper input validation, where WARN_ON macros were triggered on conditions that could legitimately occur from userspace behavior without indicating a kernel defect. The userq wait ioctl implementation contained assertions that would emit kernel backtrace warnings when the num_fences parameter was insufficient, either by deliberate underallocation or due to legitimate growth of required fences between two successive calls. These WARN_ON statements serve debugging purposes but expose kernel internals and can be abused for denial-of-service through log flooding.

RemediationAI

Update the Linux kernel to a version containing one of the stable patches: commit 1753f5f81ab60a553287f9ee659a6ac363adf8d7, 7321302edca3a349ddaea689df95b986beee6c4a, or 7b7d7693a55d606d700beb9549c9f7f0e5d9c24f. Most distributions will receive this fix through their standard kernel update channels. The patch removes the problematic WARN_ON macros from the userq wait ioctl handler, allowing userspace to receive proper error codes without triggering kernel warnings. Until patching is completed, mitigate the impact by restricting access to GPU device files (/dev/dri/*) to trusted users only and monitoring kernel logs for unusual amdgpu warning patterns that may indicate malicious userspace activity.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

Debian

linux

Release	Status	Fixed Version	Urgency
bullseye	not-affected	-	-
bullseye (security)	fixed	5.10.251-1	-
bookworm	not-affected	-	-
bookworm (security)	fixed	6.1.164-1	-
trixie	not-affected	-	-
trixie (security)	fixed	6.12.74-2	-
forky, sid	fixed	6.19.8-1	-
(unstable)	fixed	6.19.8-1	-

SUSE

Severity: Low

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

CVE-2026-23338 vulnerability details – vuln.today

Back

Linux CVE-2026-23338

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

Debian

SUSE

Share

External POC / Exploit Code