Executive brief
The Linux kernel's AMD XDNA accelerator driver contains a use-after-free vulnerability in memory mapping functions. An attacker could potentially crash the system or execute arbitrary code by triggering a race condition where freed memory regions are accessed. This affects systems using AMD XDNA hardware accelerators.
Technical details
The vulnerability is a use-after-free (CWE-416) in the AMD XDNA accelerator driver's memory management code. The functions aie2_populate_range() and amdxdna_umap_release() access a saved VMA (virtual memory area) pointer that may have already been freed by concurrent memory operations, creating a race condition. The fix removes direct VMA pointer dereferences and replaces them with safer range comparison operations using stored start/end addresses. This is a local vulnerability requiring kernel module interaction but does not require elevated privileges beyond typical process execution. The patch was merged into the mainline kernel and backported to stable branches.
Affected products
- Linux Linux kernel affected versions include those with accel/amdxdna driver (post e486147c912f)
Timeline
- 2026-08-15: disclosed
- 2026-06-08: patched: Upstream commit 1ba02717e821cf14ece642273958647e79698d3d