Executive brief
The AMD XNA (AI accelerator) driver in the Linux kernel contained a NULL pointer dereference vulnerability in mailbox channel cleanup routines. When error handling paths attempted to clean up an already-destroyed management mailbox channel, the code would crash instead of gracefully handling the NULL pointer, potentially causing kernel crashes or system instability.
Technical details
This is a NULL pointer dereference vulnerability in the amdxdna accelerator driver (drivers/accel/amdxdna/amdxdna_mailbox.c). The management mailbox channel cleanup helpers—xdna_mailbox_free_channel() and xdna_mailbox_stop_channel()—were called from error handling paths without checking whether the mailbox channel pointer had already been freed or set to NULL. An attacker with local access or a malicious userspace application could trigger an error condition in the device driver to cause a kernel NULL pointer dereference, resulting in a denial of service. The fix adds simple NULL checks to both functions to safely return early if the channel pointer is NULL, preventing the crash.
Affected products
- Linux Linux kernel affected versions in stable trees including linux-5.x, linux-6.x, and linux-7.x branches
Timeline
- 2026-08-28: disclosed: Published on NVD
- 2026-04-16: patched: Fix committed upstream (commit 506255d46bdb93a281cf39e72abbca124f5c7a1b) and backported to stable branches (commit 83d6d375f357ed2702b28d739511aad56d485de7)