Executive brief
The AMD XDNA accelerator driver in the Linux kernel has a flaw where passing a zero-length buffer to the SYNC_BO operation causes the system to crash with a kernel panic. Any user with access to the graphics device can trigger this denial of service by calling the operation with a zero-length request, causing the affected system to become unavailable until reboot.
Technical details
The vulnerability is a null/zero-length input validation flaw in the SYNC_BO ioctl handler (amdxdna_drm_sync_bo_ioctl) within the AMD XDNA accelerator driver. When a zero-length flush is requested, the code path calls drm_clflush_virt_range() which unconditionally accesses the byte at (end - 1), causing an out-of-bounds read into the vmalloc guard page. This triggers a page fault in kernel mode (supervisor read access), resulting in an Oops. The attack vector is local and requires only the ability to open a DRM render node; any unprivileged process can exploit this. The fix is straightforward: return early if size is zero before attempting any flush operation. Patches are available in both the upstream mainline and stable kernels.
Affected products
- Linux Linux kernel Versions with amdxdna driver (6.x and later with AMDXDNA acceleration support)
Timeline
- 2026-09-16: disclosed: CVE-2026-89978 published
- 2026-08-19: patched: Fix merged upstream (commit dc14753664240cedf)
- 2026-09-14: patched: Backported to stable kernels (commit 45962da5821d0a691)