Executive brief
A denial-of-service vulnerability in the AMD XDNA accelerator driver (amdxdna) allows an unprivileged local user to trigger a kernel crash by combining memory mapping, memory advisory hints, and page faults. Exploiting this vulnerability can disrupt system availability and force a reboot.
Technical details
The vulnerability is a kernel BUG_ON assertion in amdxdna_insert_pages() that can be triggered by a race condition in virtual memory flag management. An unprivileged userspace process can mmap a non-imported GEM object, call madvise(MADV_DONTNEED) to clear page table entries, and then access the memory to trigger a page fault. The buggy code sets VM_MIXEDMAP while clearing VM_PFNMAP, which allows the madvise call to succeed. When the page fault handler attempts to map the backing shmem page with vmf_insert_pfn(), the combination of VM_MIXEDMAP and a valid PFN (pfn_valid(pfn) is true) hits an explicit BUG_ON assertion. The fix removes the problematic vm_flags_mod() call and replaces pre-population logic with a unified fault-handling loop. No authentication or elevated privileges are required; only local access to the amdxdna device is needed.
Affected products
- Linux Linux kernel Vulnerable in amdxdna driver (accel/amdxdna) prior to commit 4a19f7ab5972ef608b31ae921419bc3e04b3f8ad
Timeline
- 2026-08-22: disclosed: CVE-2026-74716 published
- 2026-07-31: patched: Fix committed upstream (commit 4a19f7ab5972ef608b31ae921419bc3e04b3f8ad)