Executive brief
The Linux kernel's AMD XDNA accelerator driver contains a buffer overflow vulnerability in its query functions. When an application requests accelerator status or telemetry data, the kernel may copy more data to user space than the application's buffer can hold, potentially exposing sensitive kernel memory or causing a denial of service.
Technical details
The vulnerability exists in the amdxdna driver's query functions (aie2_query_status, aie2_query_telemetry, aie2_get_array_async_error) where copy_to_user() was called without properly limiting the size parameter to the smaller of the kernel data size or the user-supplied buffer size. The root cause is improper validation of buffer sizes before copying data from kernel to user space. An attacker with access to the amdxdna device interface can trigger this by requesting query operations with a smaller buffer than required, causing out-of-bounds data to be copied. This can leak kernel memory or cause a crash. A fix is available that caps the copy size to the minimum of the requested buffer and available data.
Affected products
- Linux Linux kernel 5.x through 6.x (amdxdna driver)
Timeline
- 2026-08-15: disclosed
- 2026-04-02: patched: Fix committed upstream by Lizhi Hou