Executive brief
The Linux kernel's AMD XDNA accelerator driver contains a race condition that can lead to a use-after-free vulnerability. The aie2_populate_range() function may access memory objects that are being concurrently released by amdxdna_umap_release(), allowing an attacker to cause a kernel crash or potentially execute arbitrary code with kernel privileges. This affects systems using AMD XDNA accelerator hardware.
Technical details
This is a use-after-free vulnerability in the AMD XDNA accelerator driver (drivers/accel/amdxdna/aie2_ctx.c). The vulnerability occurs due to a race condition between amdxdna_umap_release() and aie2_populate_range(): the release function calls the blocking mmu_interval_notifier_remove() before removing the amdxdna_umap object from abo->mem.umap_list, creating a window where aie2_populate_range() can obtain a reference to an object being freed. The fix replaces kref_get() with kref_get_unless_zero() to prevent incrementing the reference count of objects already released (refcnt=0). No authentication or special privileges are required; the vulnerability is triggered through normal driver operation. A patched kernel version is available through the Linux stable tree.
Affected products
- Linux Linux Kernel Versions with amdxdna driver (accel/amdxdna module)
Timeline
- 2026-08-15: disclosed
- 2026-07-06: patched: Fix committed upstream, backported to stable trees