CVE-2026-23288 | Linux Kernel up to 6.19.6/7.0-rc1 amdxdna memset out-of-bounds write

VDB-353002 · CVE-2026-23288 · GCVE-0-2026-23288 LINUX KERNEL UP TO 6.19.6/7.0-RC1 AMDXDNA MEMSET OUT-OF-BOUNDS WRITE HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 7.6 $5k-$25k 2.83+ Summaryinfo A vulnerability was found in Linux Kernel up to 6.19.6/7.0-rc1. It has been declared as critical. Affected by this issue is the function memset of the component amdxdna. Executing a manipulation can lead to out-of-bounds write. This vulnerability is tracked as CVE-2026-23288. No exploit exists. It is recommended to upgrade the affected component. Detailsinfo A vulnerability has been found in Linux Kernel up to 6.19.6/7.0-rc1 and classified as critical. This vulnerability affects the function memset of the component amdxdna. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes: In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix out-of-bounds memset in command slot handling The remaining space in a command slot may be smaller than the size of the command header. Clearing the command header with memset() before verifying the available slot space can result in an out-of-bounds write and memory corruption. Fix this by moving the memset() call after the size validation. The advisory is available at git.kernel.org. This vulnerability was named CVE-2026-23288 since 01/13/2026. The exploitation appears to be easy. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 03/25/2026). Upgrading to version 6.19.7, 7.0-rc1 or 7.0-rc2 eliminates this vulnerability. Applying the patch cca770d710d5e03bc814af585cd6975eb6d74074/1110a949675ebd56b3f0286e664ea543f745801c is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version. Productinfo Type Operating System Vendor Linux Name Kernel Version 6.19.0 6.19.1 6.19.2 6.19.3 6.19.4 6.19.5 6.19.6 7.0-rc1 License open-source Website Vendor: https://www.kernel.org/ CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 8.0 VulDB Meta Temp Score: 7.6 VulDB Base Score: 8.0 VulDB Temp Score: 7.6 VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Out-of-bounds write CWE: CWE-787 / CWE-119 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Partially Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: Kernel 6.19.7/7.0-rc1/7.0-rc2 Patch: cca770d710d5e03bc814af585cd6975eb6d74074/1110a949675ebd56b3f0286e664ea543f745801c Timelineinfo 01/13/2026 CVE reserved 03/25/2026 +71 days Advisory disclosed 03/25/2026 +0 days VulDB entry created 03/25/2026 +0 days VulDB entry last update Sourcesinfo Vendor: kernel.org Advisory: git.kernel.org Status: Confirmed CVE: CVE-2026-23288 (🔒) GCVE (CVE): GCVE-0-2026-23288 GCVE (VulDB): GCVE-100-353002 Entryinfo Created: 03/25/2026 12:07 Changes: 03/25/2026 12:07 (59) Complete: 🔍 Cache ID: 99:8F2:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸