LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23096: uacce: fix cdev handling in the cleanup path

In the Linux kernel, the following vulnerability has been resolved: uacce: fix cdev handling in the cleanup path When cdev_device_add fails, it internally releases the cdev memory, and if cdev_device_del is then executed, it will cause a hang error. To fix it, we check the return value of cdev_device_add() and clear uacce->cdev to avoid calling cdev_device_del in the uacce_remove.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-23096 is a Linux kernel cleanup-path bug in the uacce accelerator framework. If device registration fails, later cleanup can call deletion logic on already-released character-device memory, causing a kernel hang. The source bundle does not provide CVSS, CWE, or evidence of active exploitation.

Executive priority

Treat as a targeted Linux kernel maintenance issue until more severity data is available. Prioritize patch validation for infrastructure using accelerator hardware, but do not treat it as an emergency based on the provided evidence alone.

Technical view

The bug is in uacce cdev handling. cdev_device_add() may fail and internally release cdev memory. The vulnerable cleanup path can still call cdev_device_del() during uacce_remove(), leading to a hang. The fix checks cdev_device_add() return status and clears uacce->cdev to avoid invalid cleanup.

Likely exposure

Exposure appears limited to Linux systems using kernels with the affected uacce code path and relevant accelerator hardware or drivers. The bundle lists Linux kernel versions and stable commits, but exact downstream distribution package exposure must be verified with vendor advisories.

Exploitation context

No active exploitation is stated in the provided sources, and the CVE is not marked KEV. The available description indicates a reliability or denial-of-service style failure during device registration cleanup, not a confirmed privilege escalation or remote attack path.

Researcher notes

Evidence is sparse: no CVSS, CWE, exploit report, or downstream advisory is included. Analysis should focus on the cdev_device_add() failure path, uacce_remove() cleanup behavior, and whether local hardware-dependent conditions can trigger a system hang.

Mitigation direction

  • Check Linux distribution kernel advisories for CVE-2026-23096 coverage.
  • Update to a vendor kernel containing the referenced stable fixes.
  • Prioritize systems using uacce-supported accelerator hardware or drivers.
  • Track the listed upstream stable commits against internal kernel baselines.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and images.
  • Identify systems loading or depending on uacce-related drivers.
  • Compare kernel packages with vendor-fixed builds or upstream stable commits.
  • Review crash or hang telemetry around accelerator device registration failures.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23096 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux015d239ac0142ad0e26567fd890ef8d171f13709, 015d239ac0142ad0e26567fd890ef8d171f13709, 015d239ac0142ad0e26567fd890ef8d171f13709, 015d239ac0142ad0e26567fd890ef8d171f13709, 015d239ac0142ad0e26567fd890ef8d171f13709, 015d239ac0142ad0e26567fd890ef8d171f13709, 015d239ac0142ad0e26567fd890ef8d171f13709unaffected
LinuxLinux5.7, 0, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.