The Linux kernel’s accel/amxdna driver contains a bug in the amdxdna_insert_pages function that prematurely calls vm_ops->close on error paths. This decrements the VMA’s page pin count and releases the backing GEM object reference before the mmap system call has finished, while the VMA is still alive. Later, the normal VMA teardown re‑invokes vm_ops->close, causing a reference count underflow. This flaw can corrupt kernel memory.

All Linux kernels that load the accel/amxdna module are affected. The module is typically loaded when AMD GPU drivers are used or when it is explicitly inserted. Any system running a kernel that contains the unpatched accel/amxdna code and that allows loading of this module is potentially impacted.

The CVSS score of 7.8 reflects a high severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The issue is not listed in the CISA KEV database. Exploitation would involve triggering the error path in amdxdna_insert_pages; the description does not state the privilege level required, but based on the description it is inferred that the attack would likely be local. Successful exploitation could lead to kernel memory corruption, resulting in denial of service or, in the worst case, local privilege escalation. No active exploits have been documented at this time.