The Linux kernel’s amdxdna driver contains a use‑after‑free flaw that is triggered during iommu_sva_unbind_device(). When a device is unbound, the code accesses an iommu_mm structure after the associated mm context has already been freed, leading to a kernel crash. This crash can cause a kernel panic and a system reboot, resulting in loss of availability for all services running on the affected system.

The vulnerability is present in the linux_kernel across all releases that have not yet integrated commit a9162439. The affected code resides in the amdxdna acceleration subsystem, which is compiled into the generic Linux kernel. All kernel versions that lack the patch are vulnerable, regardless of distribution or configuration.

Exploitation requires a local, privileged user with the ability to trigger bind or unbind operations on an AMD XDNA device. Once such a user forces an unbind, the use‑after‑free will execute and crash the kernel. Remote exploitation is not documented. The EPSS score is less than 1%, indicating a low probability of real‑world exploitation that is also not listed in the CISA KEV catalog. Nevertheless, because the flaw leads to a kernel panic, its availability impact is significant if an attacker can attain the necessary privilege level.