Executive brief
A vulnerability was identified in the Linux kernel's AMD XDNA accelerator driver. The software fails to properly release system memory when certain internal operations fail during the mapping of user-allocated buffers. Over time, this could allow a local user to exhaust system memory, potentially leading to a system slowdown or crash.
Technical details
A memory leak exists in the amdxdna_ubuf_map() function within the Linux kernel's accel/amdxdna driver. The function allocates memory for scatter-gather (sg) and internal sg table structures but fails to invoke kfree() or sg_free_table() if subsequent calls to sg_alloc_table_from_pages() or dma_map_sgtable() fail. This vulnerability can be triggered by a local user with access to the accelerator device, potentially leading to kernel memory exhaustion. The issue has been resolved by adding proper error handling labels and cleanup routines in the affected driver code.
Affected products
- Linux Linux Kernel 6.13 and earlier
Timeline
- 2026-01-30: other: Patch submitted by developer
- 2026-02-26: patched: Patch committed to stable tree
- 2026-05-27: disclosed: CVE published