Executive brief
A vulnerability was identified in the Linux kernel's AMD XDNA accelerator driver. Under specific error conditions during hardware initialization, the system could experience a crash (NULL pointer dereference). This primarily impacts system stability and availability for users utilizing AMD AI accelerators.
Technical details
A NULL pointer dereference exists in the accel/amdxdna driver within the aie_destroy_context() function. The vulnerability occurs when aie2_create_context() fails during mailbox channel creation; the subsequent error handling path calls aie_destroy_context(), which incorrectly assumes the mailbox channel pointer is already initialized. An attacker or a failing system process could trigger this during context setup, leading to a kernel oops or denial of service. The fix introduces a separate request function to notify firmware of context removal without relying on the uninitialized mailbox pointer. Patches have been merged into the Linux stable tree.
Affected products
- Linux Linux Kernel 6.13 and earlier
Timeline
- 2025-12-12: disclosed: Initial patch submitted by AMD developer
- 2026-02-26: patched: Patch committed to stable kernel tree
- 2026-05-27: advisory: CVE published in NVD