PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23470 Linux CVE debrief

A deadlock vulnerability exists in the Linux kernel's drm/imagination driver soft reset sequence. The issue occurs because the soft reset is executed from a threaded IRQ handler, which calls disable_irq()—this internally waits for IRQ handlers to complete, causing the handler to wait for itself. The fix replaces disable_irq() with disable_irq_nosync() to prevent this self-deadlock condition. This is a local denial-of-service vulnerability requiring low privileges, with no impact to confidentiality or integrity.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-05-26
Advisory published
2026-04-03
Advisory updated
2026-05-26

Who should care

Linux system administrators running kernels with Imagination Technologies GPU support; embedded/IoT device manufacturers using PowerVR or similar Imagination GPUs; organizations with custom kernel builds targeting ARM or RISC-V platforms with integrated Imagination graphics

Technical summary

The vulnerability is a classic deadlock in kernel interrupt handling. The drm/imagination driver's soft reset sequence runs in a threaded IRQ handler context. When this code path calls disable_irq(), the kernel's IRQ synchronization mechanism attempts to wait for all handlers for that IRQ to complete—including the currently executing threaded handler. This creates a circular wait condition where the handler waits for itself, resulting in a soft lockup or deadlock. The resolution uses disable_irq_nosync(), which disables the IRQ without waiting for current handlers to complete, breaking the circular dependency. This vulnerability is exploitable only locally with low privileges and results in availability impact (system hang/lockup) but no data compromise.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches: 6.12.78+, 6.18.20+, 6.19.10+, or 7.0-rc5+
  • If patching is not immediately feasible, monitor systems for GPU driver hangs or soft lockups in dmesg logs indicating potential deadlock conditions
  • Review custom kernel builds using Imagination Technologies GPU drivers for inclusion of this fix
  • Validate kernel version through 'uname -r' and compare against affected version ranges

Evidence notes

CVE published 2026-04-03; modified 2026-05-26. NVD status: Analyzed. CVSS 3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. CWE-667 (Improper Locking). Affects Linux kernel versions 6.8 through 6.12.77, 6.13 through 6.18.19, 6.19 through 6.19.9, and 7.0-rc1 through rc4.

Official resources

2026-04-03