PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43446 Linux CVE debrief

CVE-2026-43446 is a Linux kernel issue in accel/amdxdna where runtime suspend can deadlock if a job is still executing and calls pm_runtime_resume_and_get() while the suspend path is draining the workqueue. The fix moves the resume call into job submission so the device is resumed before the job is queued, avoiding the deadlock.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-05-21
Advisory published
2026-05-08
Advisory updated
2026-05-21

Who should care

Linux kernel maintainers, distro security teams, and operators of systems that use the AMD XDNA accelerator driver (accel/amdxdna), especially where jobs are queued under runtime power management.

Technical summary

The source description says the runtime suspend callback drains the running job workqueue before suspending the device. If an in-flight job reaches pm_runtime_resume_and_get() during that window, the runtime suspend path and the job path can deadlock. NVD classifies the issue as CVSS 3.1 5.5/MEDIUM with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and CWE-667. The listed fix moves pm_runtime_resume_and_get() from job execution to job submission so the device is resumed before the job is queued.

Defensive priority

Medium

Recommended defensive actions

  • Apply the kernel fix referenced by the upstream stable patch links in the NVD record.
  • Prioritize updates on systems that load or use the accel/amdxdna driver.
  • Confirm whether deployed kernels match the vulnerable ranges listed by NVD: 6.19 through before 6.19.9, and 7.0-rc1 through 7.0-rc3.
  • After patching, verify suspend/resume behavior under accelerator job load to ensure no hangs remain.
  • Monitor for job queue stalls or suspend-related lockups on affected hosts until remediation is complete.

Evidence notes

This debrief is based on the supplied CVE description, the NVD analyzed record, and the official patch references listed there. The record states that the deadlock occurs when runtime suspend drains the running job workqueue while a job calls pm_runtime_resume_and_get(), and that the fix moves the resume call earlier in the submission path. NVD also provides the CVSS vector, CWE-667 mapping, and vulnerable version criteria. No KEV entry was provided in the source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43446 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43446

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43446 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43446

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6b13cb8f48a42ddf6dd98865b673a82e37ff238b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ac72e7385a2c7533dd766de4197134d96230be85

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.