The Linux kernel contains a use‑after‑free flaw in the AMD XDNA acceleration interface. When a command is submitted, the current process’s mm_struct is stored in a job structure without incrementing its reference count. Later the job is executed on a separate DRM scheduler worker thread that dereferences the stale pointer. If the mm_struct is freed before the job runs, the worker thread can access invalid memory, potentially leading to kernel memory corruption and privilege escalation. This flaw involves inadequate reference counting, corresponding to CWE‑825.

All Linux kernel builds that include the accel/amdxdna driver are affected. No specific version range is listed, so all installations that have not yet applied the referenced patch commits should be considered at risk.

The vulnerability’s severity is measured by a CVSS score of 7.8, indicating high impact. The EPSS score is <1%, reflecting a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, exploitation would require the ability to submit a job to the AMD XDNA driver, but the precise privilege level is not specified by the advisory; it could be any user with access to that driver. Successful exploitation would need to happen before the mm_struct is freed. Because the flaw involves a use‑after‑free in kernel space, it could allow arbitrary code execution with kernel privileges.