{"api_version":"1","generated_at":"2026-04-09T23:58:06+00:00","cve":"CVE-2026-23469","urls":{"html":"https://cve.report/CVE-2026-23469","api":"https://cve.report/api/cve/CVE-2026-23469.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-23469","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-23469"},"summary":{"title":"drm/imagination: Synchronize interrupts before suspending the GPU","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Synchronize interrupts before suspending the GPU\n\nThe runtime PM suspend callback doesn't know whether the IRQ handler is\nin progress on a different CPU core and doesn't wait for it to finish.\n\nDepending on timing, the IRQ handler could be running while the GPU is\nsuspended, leading to kernel crashes when trying to access GPU\nregisters. See example signature below.\n\nIn a power off sequence initiated by the runtime PM suspend callback,\nwait for any IRQ handlers in progress on other CPU cores to finish, by\ncalling synchronize_irq().\n\nAt the same time, remove the runtime PM resume/put calls in the threaded\nIRQ handler. On top of not being the right approach to begin with, and\nbeing at the wrong place as they should have wrapped all GPU register\naccesses, the driver would hit a deadlock between synchronize_irq()\nbeing called from a runtime PM suspend callback, holding the device\npower lock, and the resume callback requiring the same.\n\nExample crash signature on a TI AM68 SK platform:\n\n  [  337.241218] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError\n  [  337.241239] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G   M                6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT\n  [  337.241246] Tainted: [M]=MACHINE_CHECK\n  [  337.241249] Hardware name: Texas Instruments AM68 SK (DT)\n  [  337.241252] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  [  337.241256] pc : pvr_riscv_irq_pending+0xc/0x24\n  [  337.241277] lr : pvr_device_irq_thread_handler+0x64/0x310\n  [  337.241282] sp : ffff800085b0bd30\n  [  337.241284] x29: ffff800085b0bd50 x28: ffff0008070d9eab x27: ffff800083a5ce10\n  [  337.241291] x26: ffff000806e48f80 x25: ffff0008070d9eac x24: 0000000000000000\n  [  337.241296] x23: ffff0008068e9bf0 x22: ffff0008068e9bd0 x21: ffff800085b0bd30\n  [  337.241301] x20: ffff0008070d9e00 x19: ffff0008068e9000 x18: 0000000000000001\n  [  337.241305] x17: 637365645f656c70 x16: 0000000000000000 x15: ffff000b7df9ff40\n  [  337.241310] x14: 0000a585fe3c0d0e x13: 000000999704f060 x12: 000000000002771a\n  [  337.241314] x11: 00000000000000c0 x10: 0000000000000af0 x9 : ffff800085b0bd00\n  [  337.241318] x8 : ffff0008071175d0 x7 : 000000000000b955 x6 : 0000000000000003\n  [  337.241323] x5 : 0000000000000000 x4 : 0000000000000002 x3 : 0000000000000000\n  [  337.241327] x2 : ffff800080e39d20 x1 : ffff800080e3fc48 x0 : 0000000000000000\n  [  337.241333] Kernel panic - not syncing: Asynchronous SError Interrupt\n  [  337.241337] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G   M                6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT\n  [  337.241342] Tainted: [M]=MACHINE_CHECK\n  [  337.241343] Hardware name: Texas Instruments AM68 SK (DT)\n  [  337.241345] Call trace:\n  [  337.241348]  show_stack+0x18/0x24 (C)\n  [  337.241357]  dump_stack_lvl+0x60/0x80\n  [  337.241364]  dump_stack+0x18/0x24\n  [  337.241368]  vpanic+0x124/0x2ec\n  [  337.241373]  abort+0x0/0x4\n  [  337.241377]  add_taint+0x0/0xbc\n  [  337.241384]  arm64_serror_panic+0x70/0x80\n  [  337.241389]  do_serror+0x3c/0x74\n  [  337.241392]  el1h_64_error_handler+0x30/0x48\n  [  337.241400]  el1h_64_error+0x6c/0x70\n  [  337.241404]  pvr_riscv_irq_pending+0xc/0x24 (P)\n  [  337.241410]  irq_thread_fn+0x2c/0xb0\n  [  337.241416]  irq_thread+0x170/0x334\n  [  337.241421]  kthread+0x12c/0x210\n  [  337.241428]  ret_from_fork+0x10/0x20\n  [  337.241434] SMP: stopping secondary CPUs\n  [  337.241451] Kernel Offset: disabled\n  [  337.241453] CPU features: 0x040000,02002800,20002001,0400421b\n  [  337.241456] Memory Limit: none\n  [  337.457921] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]---","state":"PUBLISHED","assigner":"Linux","published_at":"2026-04-03 16:16:34","updated_at":"2026-04-07 13:20:55"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/8e0c15e426a056b9fb604cf87a1dfdec4d61e407","name":"https://git.kernel.org/stable/c/8e0c15e426a056b9fb604cf87a1dfdec4d61e407","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2d7f05cddf4c268cc36256a2476946041dbdd36d","name":"https://git.kernel.org/stable/c/2d7f05cddf4c268cc36256a2476946041dbdd36d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/772f3653eef50ea7cf721b05d8e275f93bc460f3","name":"https://git.kernel.org/stable/c/772f3653eef50ea7cf721b05d8e275f93bc460f3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23469","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23469","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected cc1aeedb98ad347c06ff59e991b2f94dfb4c565d 772f3653eef50ea7cf721b05d8e275f93bc460f3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected cc1aeedb98ad347c06ff59e991b2f94dfb4c565d 8e0c15e426a056b9fb604cf87a1dfdec4d61e407 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected cc1aeedb98ad347c06ff59e991b2f94dfb4c565d 2d7f05cddf4c268cc36256a2476946041dbdd36d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.8","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.8 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.20 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.19.10 6.19.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0-rc5 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"23469","cve":"CVE-2026-23469","epss":"0.000170000","percentile":"0.039750000","score_date":"2026-04-07","updated_at":"2026-04-08 00:03:39"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/imagination/pvr_device.c","drivers/gpu/drm/imagination/pvr_power.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"772f3653eef50ea7cf721b05d8e275f93bc460f3","status":"affected","version":"cc1aeedb98ad347c06ff59e991b2f94dfb4c565d","versionType":"git"},{"lessThan":"8e0c15e426a056b9fb604cf87a1dfdec4d61e407","status":"affected","version":"cc1aeedb98ad347c06ff59e991b2f94dfb4c565d","versionType":"git"},{"lessThan":"2d7f05cddf4c268cc36256a2476946041dbdd36d","status":"affected","version":"cc1aeedb98ad347c06ff59e991b2f94dfb4c565d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/imagination/pvr_device.c","drivers/gpu/drm/imagination/pvr_power.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0-rc5","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.20","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19.10","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0-rc5","versionStartIncluding":"6.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Synchronize interrupts before suspending the GPU\n\nThe runtime PM suspend callback doesn't know whether the IRQ handler is\nin progress on a different CPU core and doesn't wait for it to finish.\n\nDepending on timing, the IRQ handler could be running while the GPU is\nsuspended, leading to kernel crashes when trying to access GPU\nregisters. See example signature below.\n\nIn a power off sequence initiated by the runtime PM suspend callback,\nwait for any IRQ handlers in progress on other CPU cores to finish, by\ncalling synchronize_irq().\n\nAt the same time, remove the runtime PM resume/put calls in the threaded\nIRQ handler. On top of not being the right approach to begin with, and\nbeing at the wrong place as they should have wrapped all GPU register\naccesses, the driver would hit a deadlock between synchronize_irq()\nbeing called from a runtime PM suspend callback, holding the device\npower lock, and the resume callback requiring the same.\n\nExample crash signature on a TI AM68 SK platform:\n\n  [  337.241218] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError\n  [  337.241239] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G   M                6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT\n  [  337.241246] Tainted: [M]=MACHINE_CHECK\n  [  337.241249] Hardware name: Texas Instruments AM68 SK (DT)\n  [  337.241252] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  [  337.241256] pc : pvr_riscv_irq_pending+0xc/0x24\n  [  337.241277] lr : pvr_device_irq_thread_handler+0x64/0x310\n  [  337.241282] sp : ffff800085b0bd30\n  [  337.241284] x29: ffff800085b0bd50 x28: ffff0008070d9eab x27: ffff800083a5ce10\n  [  337.241291] x26: ffff000806e48f80 x25: ffff0008070d9eac x24: 0000000000000000\n  [  337.241296] x23: ffff0008068e9bf0 x22: ffff0008068e9bd0 x21: ffff800085b0bd30\n  [  337.241301] x20: ffff0008070d9e00 x19: ffff0008068e9000 x18: 0000000000000001\n  [  337.241305] x17: 637365645f656c70 x16: 0000000000000000 x15: ffff000b7df9ff40\n  [  337.241310] x14: 0000a585fe3c0d0e x13: 000000999704f060 x12: 000000000002771a\n  [  337.241314] x11: 00000000000000c0 x10: 0000000000000af0 x9 : ffff800085b0bd00\n  [  337.241318] x8 : ffff0008071175d0 x7 : 000000000000b955 x6 : 0000000000000003\n  [  337.241323] x5 : 0000000000000000 x4 : 0000000000000002 x3 : 0000000000000000\n  [  337.241327] x2 : ffff800080e39d20 x1 : ffff800080e3fc48 x0 : 0000000000000000\n  [  337.241333] Kernel panic - not syncing: Asynchronous SError Interrupt\n  [  337.241337] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G   M                6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT\n  [  337.241342] Tainted: [M]=MACHINE_CHECK\n  [  337.241343] Hardware name: Texas Instruments AM68 SK (DT)\n  [  337.241345] Call trace:\n  [  337.241348]  show_stack+0x18/0x24 (C)\n  [  337.241357]  dump_stack_lvl+0x60/0x80\n  [  337.241364]  dump_stack+0x18/0x24\n  [  337.241368]  vpanic+0x124/0x2ec\n  [  337.241373]  abort+0x0/0x4\n  [  337.241377]  add_taint+0x0/0xbc\n  [  337.241384]  arm64_serror_panic+0x70/0x80\n  [  337.241389]  do_serror+0x3c/0x74\n  [  337.241392]  el1h_64_error_handler+0x30/0x48\n  [  337.241400]  el1h_64_error+0x6c/0x70\n  [  337.241404]  pvr_riscv_irq_pending+0xc/0x24 (P)\n  [  337.241410]  irq_thread_fn+0x2c/0xb0\n  [  337.241416]  irq_thread+0x170/0x334\n  [  337.241421]  kthread+0x12c/0x210\n  [  337.241428]  ret_from_fork+0x10/0x20\n  [  337.241434] SMP: stopping secondary CPUs\n  [  337.241451] Kernel Offset: disabled\n  [  337.241453] CPU features: 0x040000,02002800,20002001,0400421b\n  [  337.241456] Memory Limit: none\n  [  337.457921] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]---"}],"providerMetadata":{"dateUpdated":"2026-04-03T15:15:48.599Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/772f3653eef50ea7cf721b05d8e275f93bc460f3"},{"url":"https://git.kernel.org/stable/c/8e0c15e426a056b9fb604cf87a1dfdec4d61e407"},{"url":"https://git.kernel.org/stable/c/2d7f05cddf4c268cc36256a2476946041dbdd36d"}],"title":"drm/imagination: Synchronize interrupts before suspending the GPU","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-23469","datePublished":"2026-04-03T15:15:48.599Z","dateReserved":"2026-01-13T15:37:46.021Z","dateUpdated":"2026-04-03T15:15:48.599Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-04-03 16:16:34","lastModifiedDate":"2026-04-07 13:20:55","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"23469","Ordinal":"1","Title":"drm/imagination: Synchronize interrupts before suspending the GP","CVE":"CVE-2026-23469","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"23469","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Synchronize interrupts before suspending the GPU\n\nThe runtime PM suspend callback doesn't know whether the IRQ handler is\nin progress on a different CPU core and doesn't wait for it to finish.\n\nDepending on timing, the IRQ handler could be running while the GPU is\nsuspended, leading to kernel crashes when trying to access GPU\nregisters. See example signature below.\n\nIn a power off sequence initiated by the runtime PM suspend callback,\nwait for any IRQ handlers in progress on other CPU cores to finish, by\ncalling synchronize_irq().\n\nAt the same time, remove the runtime PM resume/put calls in the threaded\nIRQ handler. On top of not being the right approach to begin with, and\nbeing at the wrong place as they should have wrapped all GPU register\naccesses, the driver would hit a deadlock between synchronize_irq()\nbeing called from a runtime PM suspend callback, holding the device\npower lock, and the resume callback requiring the same.\n\nExample crash signature on a TI AM68 SK platform:\n\n  [  337.241218] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError\n  [  337.241239] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G   M                6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT\n  [  337.241246] Tainted: [M]=MACHINE_CHECK\n  [  337.241249] Hardware name: Texas Instruments AM68 SK (DT)\n  [  337.241252] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  [  337.241256] pc : pvr_riscv_irq_pending+0xc/0x24\n  [  337.241277] lr : pvr_device_irq_thread_handler+0x64/0x310\n  [  337.241282] sp : ffff800085b0bd30\n  [  337.241284] x29: ffff800085b0bd50 x28: ffff0008070d9eab x27: ffff800083a5ce10\n  [  337.241291] x26: ffff000806e48f80 x25: ffff0008070d9eac x24: 0000000000000000\n  [  337.241296] x23: ffff0008068e9bf0 x22: ffff0008068e9bd0 x21: ffff800085b0bd30\n  [  337.241301] x20: ffff0008070d9e00 x19: ffff0008068e9000 x18: 0000000000000001\n  [  337.241305] x17: 637365645f656c70 x16: 0000000000000000 x15: ffff000b7df9ff40\n  [  337.241310] x14: 0000a585fe3c0d0e x13: 000000999704f060 x12: 000000000002771a\n  [  337.241314] x11: 00000000000000c0 x10: 0000000000000af0 x9 : ffff800085b0bd00\n  [  337.241318] x8 : ffff0008071175d0 x7 : 000000000000b955 x6 : 0000000000000003\n  [  337.241323] x5 : 0000000000000000 x4 : 0000000000000002 x3 : 0000000000000000\n  [  337.241327] x2 : ffff800080e39d20 x1 : ffff800080e3fc48 x0 : 0000000000000000\n  [  337.241333] Kernel panic - not syncing: Asynchronous SError Interrupt\n  [  337.241337] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G   M                6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT\n  [  337.241342] Tainted: [M]=MACHINE_CHECK\n  [  337.241343] Hardware name: Texas Instruments AM68 SK (DT)\n  [  337.241345] Call trace:\n  [  337.241348]  show_stack+0x18/0x24 (C)\n  [  337.241357]  dump_stack_lvl+0x60/0x80\n  [  337.241364]  dump_stack+0x18/0x24\n  [  337.241368]  vpanic+0x124/0x2ec\n  [  337.241373]  abort+0x0/0x4\n  [  337.241377]  add_taint+0x0/0xbc\n  [  337.241384]  arm64_serror_panic+0x70/0x80\n  [  337.241389]  do_serror+0x3c/0x74\n  [  337.241392]  el1h_64_error_handler+0x30/0x48\n  [  337.241400]  el1h_64_error+0x6c/0x70\n  [  337.241404]  pvr_riscv_irq_pending+0xc/0x24 (P)\n  [  337.241410]  irq_thread_fn+0x2c/0xb0\n  [  337.241416]  irq_thread+0x170/0x334\n  [  337.241421]  kthread+0x12c/0x210\n  [  337.241428]  ret_from_fork+0x10/0x20\n  [  337.241434] SMP: stopping secondary CPUs\n  [  337.241451] Kernel Offset: disabled\n  [  337.241453] CPU features: 0x040000,02002800,20002001,0400421b\n  [  337.241456] Memory Limit: none\n  [  337.457921] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]---","Type":"Description","Title":"drm/imagination: Synchronize interrupts before suspending the GP"}]}}}