Executive brief
A vulnerability was identified in the Linux kernel's AMD accelerator driver (amdxdna) that could allow a local user to cause system instability or potentially gain unauthorized access. The issue occurs when the system incorrectly calculates the size of memory buffers requested by user applications, leading to memory corruption. This could result in a system crash or allow an attacker to compromise the integrity of the operating system.
Technical details
An integer overflow vulnerability exists in the amdxdna driver within the Linux kernel, specifically in the amdxdna_get_ubuf function in drivers/accel/amdxdna/amdxdna_ubuf.c. The vulnerability is caused by a lack of overflow validation when calculating the total size of user-allocated buffers (ubuf) by summing individual segment lengths. A local attacker with access to the accelerator device can provide crafted inputs that trigger an integer overflow, resulting in an undersized memory allocation. This can subsequently lead to out-of-bounds memory access and kernel memory corruption. The fix introduces the check_add_overflow() helper to validate the size calculation before allocation.
Affected products
- Linux Linux Kernel 6.18 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1
Timeline
- 2026-03-25: advisory: Initial disclosure of CVE-2026-23280
- 2026-02-23: patched: Mainline patch committed