Executive brief
A vulnerability was identified in the Linux kernel's AMD accelerator driver. This component manages specialized hardware used for high-performance computing tasks. An attacker with local access to the system could exploit this flaw to cause a system crash or potentially access sensitive information by providing a specially crafted command that exceeds the expected memory limits.
Technical details
A vulnerability exists in the amdxdna driver (specifically within drivers/accel/amdxdna/amdxdna_ctx.c) of the Linux kernel. The 'count' field in the command header, which determines the payload size, was not verified against the actual remaining buffer space. A local attacker with low privileges can provide a malicious command header where the payload count exceeds the allocated buffer size. This can result in an out-of-bounds read or write, leading to a denial of service (system crash) or information disclosure. The issue has been addressed by adding bounds checking to ensure the payload does not exceed the buffer's memory size.
Affected products
- Linux Linux Kernel 6.14 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-03: disclosed
- 2026-04-03: advisory
- 2026-03-12: patched