Medium 5.5Published Feb 4, 2026

CVE-2026-23063uacce: ensure safe queue release with state management

Updated under an hour ago (Oct 26, 2026, 11:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: uacce: ensure safe queue release with state management Directly calling `put_queue` carries risks since it cannot guarantee that resources of `uacce_queue` have been fully released beforehand. So adding a `stop_queue` operation for the UACCE_CMD_PUT_Q command and leaving the `put_queue` operation to the final resource release ensures safety. Queue states are defined as follows: - UACCE_Q_ZOMBIE: Initial state - UACCE_Q_INIT: After opening `uacce` - UACCE_Q_STARTED: After `start` is issued via `ioctl` When executing `poweroff -f` in virt while accelerator are still working, `uacce_fops_release` and `uacce_remove` may execute concurrently. This can cause `uacce_put_queue` within `uacce_fops_release` to access a NULL `ops` pointer. Therefore, add state checks to prevent accessing freed pointers.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 015d239ac0142ad0e26567fd890ef8d171f13709 before b457abeb5d962db88aaf60e249402fd3073dbfab; 015d239ac0142ad0e26567fd890ef8d171f13709 builds before 8b57bf1d3b1db692f34bce694a03e41be79f6016; from 015d239ac0142ad0e26567fd890ef8d171f13709 before 336fb41a186e7c0415ae94fec9e23d1f04b87483; from 015d239ac0142ad0e26567fd890ef8d171f13709 before 43f233eb6e7b9d88536881a9bc43726d0e34800d; from 015d239ac0142ad0e26567fd890ef8d171f13709 before 47634d70073890c9c37e39ab4ff93d4b585b028a; from 015d239ac0142ad0e26567fd890ef8d171f13709 before 92e4f11e29b98ef424ff72d6371acac03e5d973c; from 015d239ac0142ad0e26567fd890ef8d171f13709 before 26c08dabe5475d99a13f353d8dd70e518de45663	CNA record
linux linux_kernel linux:linux_kernel	from 5.7 before 5.10.249; from 5.11 before 5.15.199; from 5.16 before 6.1.162; from 6.2 before 6.6.122; from 6.7 before 6.12.68; from 6.13 before 6.18.8; 6.19; 6.19; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/b457abeb5d962db88aaf60e249402fd3073dbfab	patch
https://git.kernel.org/stable/c/8b57bf1d3b1db692f34bce694a03e41be79f6016	patch
https://git.kernel.org/stable/c/336fb41a186e7c0415ae94fec9e23d1f04b87483	patch
https://git.kernel.org/stable/c/43f233eb6e7b9d88536881a9bc43726d0e34800d	patch
https://git.kernel.org/stable/c/47634d70073890c9c37e39ab4ff93d4b585b028a	patch
https://git.kernel.org/stable/c/92e4f11e29b98ef424ff72d6371acac03e5d973c	patch
https://git.kernel.org/stable/c/26c08dabe5475d99a13f353d8dd70e518de45663	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.