CVE-2026-23470

MediumCVSS 5.5/10Last modified Jul 24, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: Fix deadlock in soft reset sequence

The soft reset sequence is currently executed from the threaded IRQ handler, hence it cannot call disable_irq() which internally waits for IRQ handlers, i.e. itself, to complete.

Use disable_irq_nosync() during a soft reset instead.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

VendorProductVersions
LinuxLinux>= cc1aeedb98ad347c06ff59e991b2f94dfb4c565d, < f99e8b813ae5ce8ffd62c33f5753bf0a008af4b1; >= cc1aeedb98ad347c06ff59e991b2f94dfb4c565d, < 9497b1f309436971726e229aa6026954ea7c28e9; >= cc1aeedb98ad347c06ff59e991b2f94dfb4c565d, < 6f39b48a2d3b1fe83f99477250cd0cd67ca1e1c6; >= cc1aeedb98ad347c06ff59e991b2f94dfb4c565d, < a55c2a5c8d680156495b7b1e2a9f5a3e313ba524
LinuxLinux6.8

References

Timeline

Published
Apr 3, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-234725.5In the Linux kernel, the following vulnerability has been resolved: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN uart_wCVE-2026-234745.5In the Linux kernel, the following vulnerability has been resolved: mtd: Avoid boot crash in RedBoot partition table parser Given CONFIG_FCVE-2026-234755.5In the Linux kernel, the following vulnerability has been resolved: spi: fix statistics allocation The controller per-cpu statistics is noCVE-2026-234765.4FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScrCVE-2026-234776.5Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GECVE-2026-234789.8Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that alloCVE-2026-234798.8Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return CVE-2026-23485.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Quick Edit allows Cross-Site ScCVE-2026-234808.8Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is a privilege escalation vulnerability. The upsertUser endpCVE-2026-234816.5Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is an authenticated arbitrary file write vulnerability in saCVE-2026-234827.5Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform permission checks on theCVE-2026-234835.3Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses join() to concatena
CVE-2026-23470: Medium severity, CVSS 5.5 | Vulnix