In the Linux kernel, the following vulnerability has been resolved:
uacce: ensure safe queue release with state management
Directly calling put_queue carries risks since it cannot
guarantee that resources of uacce_queue have been fully released
beforehand. So adding a stop_queue operation for the
UACCECMDPUT_Q command and leaving the put_queue operation to
the final resource release ensures safety.
Queue states are defined as follows:
- UACCEQZOMBIE: Initial state
- UACCEQINIT: After opening uacce
- UACCEQSTARTED: After start is issued via ioctl
When executing poweroff -f in virt while accelerator are still
working, uacce_fops_release and uacce_remove may execute
concurrently. This can cause uacce_put_queue within
uacce_fops_release to access a NULL ops pointer. Therefore, add
state checks to prevent accessing freed pointers.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23063.json",
"cna_assigner": "Linux"
}