Executive brief
A vulnerability in the Linux kernel's AMD XDNA driver could allow a local user to cause a system crash. The issue occurs when the system attempts to run new tasks while simultaneously cleaning up hardware resources, leading to memory corruption. This could result in a denial-of-service or instability on systems using AMD AI accelerators.
Technical details
A use-after-free (UAF) vulnerability exists in the accel/amdxdna driver within the Linux kernel. The root cause is a race condition where jobs can be scheduled on a hardware context while aie2_release_resource() is in the process of freeing associated resources. An attacker with local access could potentially trigger this race to cause a kernel panic or memory corruption. The fix involves stopping the DRM scheduler (drm_sched_stop) before resource release and implementing a status check in aie2_sched_job_run() to ensure the hardware context is still active. Patches have been applied to multiple stable branches of the Linux kernel.
Affected products
- Linux Linux Kernel 6.12, 6.13, 6.14
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory