CVE-2023-54326 misc: pci_endpoint_test: Free IRQs before removing the device
A race condition in the Linux kernel PCI endpoint test driver allows IRQ handlers to access freed memory, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-54326?
CVE-2023-54326 is a high-severity vulnerability in Linux, published on 30 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
misc: pci_endpoint_test: Free IRQs before removing the device
In pci_endpoint_test_remove(), freeing the IRQs after removing the device creates a small race window for IRQs to be received with the test device memory already released, causing the IRQ handler to access invalid memory, resulting in an oops.
Free the device IRQs before removing the device to avoid this issue.
Which versions are affected by CVE-2023-54326?
How do I fix CVE-2023-54326?
Apply the vendor's patch.
Is CVE-2023-54326 being exploited?
There is no known exploitation of CVE-2023-54326 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-54326, DEBIAN-CVE-2023-54326, GHSA-87qv-rjw5-q2ph, UBUNTU-CVE-2023-54326.