What is the CVSS score of CVE-2026-23348?

CVE-2026-23348 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-23348?

Yes, a patch is available for CVE-2026-23348. Update the affected software to the latest version immediately.

Linux CVE-2026-23348

EUVD-2026-15317 MEDIUM

Race Condition (CWE-362)

2026-03-25 Linux

GHSA-j48g-pw4c-x8jm

Denial Of Service Linux Race Condition

4.7

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-362 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V15 - Secure Coding and Architecture Concurrency control, locking MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS score and vector are not provided, limiting traditional CVSS-based assessment; however, the vulnerability demonstrates high practical impact despite moderate attack complexity. The attack vector is local (requires system access or timing control during module operations), the impact is denial of service (kernel panic), and the attack requires specific conditions (module dependency ordering and timing). EPSS risk and KEV status are not reported, suggesting this is a post-disclosure or pending-disclosure vulnerability. The patch availability through three kernel.org stable commits (5fc4e150c5ada5f7d20d8f9f1b351f10481fbdf7, 5b230daeee420833287cc77314439903e5312f10, 96a1fd0d84b17360840f344826897fa71049870e) indicates the vulnerability has been fixed in stable branches. Real-world risk is moderate to high for systems with CXL hardware (emerging server/enterprise platforms) running unpatched kernels with both cxl_acpi and cxl_pmem modules enabled; however, this is not widespread consumer exposure. The synchronization fix (PROBE_FORCE_SYNCHRONOUS, device locking, invalidation flags) is non-trivial, indicating the race was difficult to trigger but severe when it occurs.
Exploit ScenarioDerived	A system administrator or local attacker can trigger this vulnerability by executing rapid module unload/reload cycles on systems with CXL hardware and CXL kernel modules enabled, or by running the cxl-translate.sh unit test with a 3-second sleep injected before the critical probe sequence. The race condition causes the kernel to panic with a NULL pointer dereference when an orphaned nvdimm object attempts to reprobe after the cxl_acpi module (which registered the nvdimm_bus) has been removed, effectively achieving a denial-of-service condition. No special privileges or remote access are required if the attacker has local shell access or can trigger module operations through an exposed userspace interface.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

A race condition exists in the Linux kernel's CXL (Compute Express Link) subsystem where the nvdimm_bus object can be invalidated while orphaned nvdimm objects attempt to reprobe, leading to a NULL pointer dereference in kobject_get() during device registration. This affects Linux kernels with CXL support enabled, allowing a local attacker or system administrator to trigger a kernel panic (denial of service) through module unload/reload sequences or specific timing during CXL ACPI probe operations. No active exploitation in the wild has been reported, but the vulnerability is easily reproducible via the cxl-translate.sh unit test with minimal timing manipulation.

RemediationAI

Upgrade the Linux kernel to a stable version that includes the CXL nvdimm_bus race condition fix from the referenced commits (available from kernel.org stable branches and major Linux distributions' kernel updates). The primary fix involves three key changes: (1) setting the cxl_nvb probe_type to PROBE_FORCE_SYNCHRONOUS to ensure synchronous driver probing, (2) implementing checks in devm_cxl_add_nvdimm_bridge() to verify driver attachment during cxl_acpi_probe(), and (3) adding proper locking mechanisms around nvdimm_bus validity checks and setting the CXL_NVD_F_INVALIDATED flag to prevent orphaned device probing. Until kernel patching is feasible, restrict CXL module operations by avoiding dynamic unload/reload of cxl_acpi without full system quiescence, or disable CXL support entirely if the hardware is not in use. Distribution kernel maintainers should backport the referenced commits to all stable/LTS kernel branches with CXL support enabled.

Affected VersionsENISA

Linux patch: 0

Linux patch: 6.19.7

Linux patch: 7.0-rc2

Linux 8fdcb1704f61a8fd9be0f3849a174d084def0666 <96a1fd0d84b17360840f344826897fa71049870e

Linux patch: 6.18.17

Linux 8fdcb1704f61a8fd9be0f3849a174d084def0666 <5fc4e150c5ada5f7d20d8f9f1b351f10481fbdf7

Linux 5.14

Linux 8fdcb1704f61a8fd9be0f3849a174d084def0666 <5b230daeee420833287cc77314439903e5312f10

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the Linux kernel's CXL (Compute Express Link) driver subsystem, specifically in the interaction between cxl_acpi, cxl_core, and cxl_pmem modules with the libnvdimm (Non-Volatile DIMM) subsystem. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, indicating all Linux kernel versions with CXL support. The root cause is a race condition (CWE-362 or CWE-667) where the cxl_nvb (NVDimm Bridge) object's nvdimm_bus registration can be removed while orphaned nvdimm devices are still attempting to probe. When __nd_device_register() executes without a valid nvdimm_bus parent, it triggers a NULL pointer dereference at offset 0x6c in the device struct (the dev->parent pointer), specifically in kobject_get() when attempting to increment the reference count of the missing parent device. The issue manifests through asynchronous workqueue processing (cxl_port cxl_bus_rescan_queue) that races against module removal.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

SUSE 5.2 MEDIUM

Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Apr 24, 2026 - 18:22 NVD

4.7 (MEDIUM)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 25, 2026 - 10:27 nvd

N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

cxl: Fix race of nvdimm_bus object when creating nvdimm objects

Found issue during running of cxl-translate.sh unit test. Adding a 3s sleep right before the test seems to make the issue reproduce fairly consistently. The cxl_translate module has dependency on cxl_acpi and causes orphaned nvdimm objects to reprobe after cxl_acpi is removed. The nvdimm_bus object is registered by the cxl_nvb object when cxl_acpi_probe() is called. With the nvdimm_bus object missing, __nd_device_register() will trigger NULL pointer dereference when accessing the dev->parent that points to &nvdimm_bus->dev.

[ 192.884510] BUG: kernel NULL pointer dereference, address: 000000000000006c [ 192.895383] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20250812-19.fc42 08/12/2025 [ 192.897721] Workqueue: cxl_port cxl_bus_rescan_queue [cxl_core] [ 192.899459] RIP: 0010:kobject_get+0xc/0x90 [ 192.924871] Call Trace: [ 192.925959] <TASK> [ 192.926976] ? pm_runtime_init+0xb9/0xe0 [ 192.929712] __nd_device_register.part.0+0x4d/0xc0 [libnvdimm] [ 192.933314] __nvdimm_create+0x206/0x290 [libnvdimm] [ 192.936662] cxl_nvdimm_probe+0x119/0x1d0 [cxl_pmem] [ 192.940245] cxl_bus_probe+0x1a/0x60 [cxl_core] [ 192.943349] really_probe+0xde/0x380

This patch also relies on the previous change where devm_cxl_add_nvdimm_bridge() is called from drivers/cxl/pmem.c instead of drivers/cxl/core.c to ensure the dependency of cxl_acpi on cxl_pmem.

Set probe_type of cxl_nvb to PROBE_FORCE_SYNCHRONOUS to ensure the

driver is probed synchronously when add_device() is called.

Add a check in __devm_cxl_add_nvdimm_bridge() to ensure that the

cxl_nvb driver is attached during cxl_acpi_probe().

Take the cxl_root uport_dev lock and the cxl_nvb->dev lock in

devm_cxl_add_nvdimm() before checking nvdimm_bus is valid.

Set cxl_nvdimm flag to CXL_NVD_F_INVALIDATED so cxl_nvdimm_probe()

will exit with -EBUSY.

The removal of cxl_nvdimm devices should prevent any orphaned devices from probing once the nvdimm_bus is gone.

[ dj: Fixed 0-day reported kdoc issue. ] [ dj: Fix cxl_nvb reference leak on error. Gregory (kreview-0811365) ]

Threat Intelligence Overview

EPSS Score

0.0%

Top 96% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +24

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-362 – Race Condition

View all

CVE-2023-36884 HIGH POC

7.5

CVE-2016-5195 HIGH POC

7.0

CVE-2017-1000112 HIGH POC

7.0

CVE-2014-0196 MEDIUM POC

5.5

CVE-2014-0226 MEDIUM POC

6.8

CVE-2016-1757 HIGH POC

7.0

CVE-2016-8655 HIGH POC

7.8

CVE-2025-39964 MEDIUM POC

5.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

Debian

linux

Release	Status	Fixed Version	Urgency
bullseye	not-affected	-	-
bullseye (security)	fixed	5.10.251-1	-
bookworm	vulnerable	6.1.159-1	-
bookworm (security)	vulnerable	6.1.164-1	-
trixie	vulnerable	6.12.73-1	-
trixie (security)	vulnerable	6.12.74-2	-
forky, sid	fixed	6.19.8-1	-
(unstable)	fixed	6.19.8-1	-

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23348 ADVISORY https://vuldb.com/vuln/353012 REF https://git.kernel.org/stable/c/5b230daeee420833287cc77314439903e5312f10 REF https://git.kernel.org/stable/c/5fc4e150c5ada5f7d20d8f9f1b351f10481fbdf7 REF https://git.kernel.org/stable/c/96a1fd0d84b17360840f344826897fa71049870e

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back