The kernel’s amdxdna driver contains a use‑after‑free bug triggered during the unbinding of an AMD XDNA device. When iommu_sva_unbind_device() is called, it accesses an iommu_mm structure after the associated mm context has already been freed, causing a kernel crash that can bring the entire system down.

The issue exists in all versions of the Linux kernel that have not applied the fix contained in commit a9162439. Any distribution running an unpatched kernel, regardless of its version or configuration, is potentially vulnerable. The problem resides in the amdxdna acceleration subsystem built into the generic kernel.

Based on the description, the likely attack vector is a local user with sufficient privileges to trigger bind or unbind operations on the AMD XDNA device. The flaw carries a CVSS score of 7.8, indicating high severity, but the EPSS score is less than 1 %, showing a very low likelihood of real-world exploitation. The vulnerability is not listed in the CISA KEV catalog. No remote attack vector is documented. An attacker who succeeds would cause a kernel panic, resulting in denial of service for all running services.