LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23264: Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"

In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" This reverts commit 7294863a6f01248d72b61d38478978d638641bee. This commit was erroneously applied again after commit 0ab5d711ec74 ("drm/amd: Refactor `amdgpu_aspm` to be evaluated per device") removed it, leading to very hard to debug crashes, when used with a system with two AMD GPUs of which only one supports ASPM. (cherry picked from commit 97a9689300eb2b393ba5efc17c8e5db835917080)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel AMD graphics driver regression that can cause difficult-to-diagnose crashes on systems with two AMD GPUs where only one supports ASPM. The source describes a fix as reverting an erroneously re-applied commit. No CVSS score, CWE, or active exploitation evidence is provided.

Executive priority

Treat this as a targeted stability and availability issue, not a broad internet-exposed emergency. Patch through normal kernel maintenance, with faster handling for GPU-heavy workstations, servers, or production systems matching the dual AMD GPU condition.

Technical view

The issue is in Linux drm/amd ASPM handling. A commit checking ASPM via the PCIe subsystem was reintroduced after a per-device amdgpu_aspm refactor had removed it, causing crashes on mixed-ASPM dual AMD GPU systems. The listed stable references are revert fixes.

Likely exposure

Exposure appears limited to Linux systems using affected kernels and AMD GPU configurations, especially dual AMD GPU hosts with mixed ASPM support. Exact distribution package exposure is not proven by the bundle and should be checked against vendor kernel advisories.

Exploitation context

The bundle does not cite KEV listing, exploit activity, public exploit code, or a remote attack path. The described impact is crash behavior from a kernel driver regression under specific hardware conditions.

Researcher notes

Evidence is narrow but specific: the upstream description names the bad reapplication and affected mixed-ASPM hardware pattern. The bundle lacks CVSS, CWE, exploitability analysis, and distribution-level affected package mapping, so avoid broad claims beyond the kernel regression and revert fixes.

Mitigation direction

  • Apply Linux stable or distribution kernel updates containing the revert fix.
  • Prioritize systems with two AMD GPUs and mixed ASPM capability.
  • Check distribution advisories and changelogs for CVE-2026-23264 backports.
  • If no update is available, follow vendor guidance; no temporary workaround is named.

Validation and detection

  • Inventory Linux kernel versions on systems with AMD GPUs.
  • Identify dual AMD GPU hosts and whether ASPM support differs by device.
  • Confirm the installed kernel includes the relevant stable revert or vendor backport.
  • Review crash reports for drm/amd or amdgpu activity on affected hosts.
  • Regression-test normal GPU workloads after kernel update.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23264 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0ab5d711ec74d9e60673900974806b7688857947, 0ab5d711ec74d9e60673900974806b7688857947, 0ab5d711ec74d9e60673900974806b7688857947, 0ab5d711ec74d9e60673900974806b7688857947, 0ab5d711ec74d9e60673900974806b7688857947, 0a9a60dcedaacde4b903337b7445cb431b4dd119, 5.15.54unaffected
LinuxLinux5.18, 0, 6.1.163, 6.6.124, 6.12.70, 6.18.10, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.