Executive brief
A bug in the AMD XNA accelerator driver's memory mapping code causes reference count underflows when errors occur during page insertion. When errors happen, the kernel prematurely closes the memory mapping and releases resources while the user-space mapping is still active, leading to a double-release when the process later unmaps the memory. This can cause kernel memory corruption or a denial of service.
Technical details
The amdxdna_insert_pages() function in the AMD XNA accelerator driver contains two error paths that incorrectly call vma->vm_ops->close(vma) before returning errors to the caller. The function is called from amdxdna_gem_obj_mmap() after an HMM (Heterogeneous Memory Management) interval notifier has been registered. When page insertion fails, the error path manually closes the VMA, which drops reference counts and releases resources backing the VMA, before the mmap() syscall has even returned. The kernel VMA teardown later calls close again when the process unmaps the range, causing a reference count underflow. The fix replaces hard-error returns with a deferred-fault approach using amdxdna_mark_mapp_invalid(), which marks the mapping invalid and retries page insertion through the HMM range-fault path, keeping the VMA alive until proper teardown occurs. A patch has been committed to the Linux kernel.
Affected products
- Linux Linux kernel Affected versions prior to commit 8d51e0fd3e698919d2adeff71936377f0c0d4aa0; introduced in commit e486147c912f
Timeline
- 2026-08-22: disclosed
- 2026-07-31: patched: Patch committed upstream