Description
In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: put the chained BO when its mapping fails

amdxdna_cmd_set_error() looks up the first BO of a command chain, which
takes a reference, and drops it at the end of the function. The mapping of
that BO is established in between, and the failure path returns without the
put, so the reference is leaked.

Ordinary use does not reach it. The chain has been submitted before any of
this runs, so aie2_cmdlist_fill_slot() has already called
amdxdna_cmd_get_op() on that BO and amdxdna_gem_vmap() has cached its
address. What makes it reachable is that the BO is resolved again by
handle here, and the handle is userspace's to recycle: closing it after
submission and importing a dma-buf whose exporter implements no vmap onto
the same id leaves amdxdna_gem_get_obj() returning an object this cannot
map, since prime_import() types every import AMDXDNA_BO_SHARE.
Published: 2026-09-25
Score: n/a
EPSS: n/a
KEV: No
Impact: Resource Leak / Potential DoS
Action: Assess Impact
AI Analysis

Impact

In the Linux kernel, a resource management error was found in the AMD XDNA acceleration subsystem. The code that releases a physical buffer object (BO) after command submission sometimes fails to drop the reference when the mapping of that BO fails. Because the reference is leaked, the kernel keeps an extra hold on the BO, which can lead to resource exhaustion and degrade system stability. The flaw belongs to the class of resource leakage vulnerabilities (CWE‑399).

Affected Systems

The issue affects the Linux kernel's AMD XDNA acceleration driver. It was identified when the AMD XDNA command chain was processed following a user‑space buffer import that lacked a viable mapping. Any Linux kernel build that includes the amdxdna subsystem is potentially affected, though the specific kernel versions are not enumerated in the advisory.

Risk and Exploitability

The flaw is not listed in the CISA KEV catalog and no EPSS score is available, indicating that automated exploitation is unlikely at present. The vulnerability requires kernel‑level access to trigger the erroneous path, and it does not provide a direct attack surface for privilege escalation. The risk is therefore moderate, primarily as a potential denial‑of‑service vector if an attacker can repeatedly cause mapping failures within the amdxdna subsystem.

Generated by OpenCVE AI on September 25, 2026 at 12:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a kernel version that includes the amdxdna reference‑release fix.
  • If an immediate kernel upgrade is not possible, disable the AMD XDNA acceleration driver or prevent user‑space processes from submitting commands to the subsystem.
  • Monitor system logs for repeated BO mapping failures or memory usage growth indicative of the resource leak.

Generated by OpenCVE AI on September 25, 2026 at 12:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-399

Fri, 25 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdna_cmd_set_error() looks up the first BO of a command chain, which takes a reference, and drops it at the end of the function. The mapping of that BO is established in between, and the failure path returns without the put, so the reference is leaked. Ordinary use does not reach it. The chain has been submitted before any of this runs, so aie2_cmdlist_fill_slot() has already called amdxdna_cmd_get_op() on that BO and amdxdna_gem_vmap() has cached its address. What makes it reachable is that the BO is resolved again by handle here, and the handle is userspace's to recycle: closing it after submission and importing a dma-buf whose exporter implements no vmap onto the same id leaves amdxdna_gem_get_obj() returning an object this cannot map, since prime_import() types every import AMDXDNA_BO_SHARE.
Title accel/amdxdna: put the chained BO when its mapping fails
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T10:36:19.093Z

Reserved: 2026-09-25T10:25:14.319Z

Link: CVE-2026-98144

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-25T11:17:45.933

Modified: 2026-09-25T11:17:45.933

Link: CVE-2026-98144

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T12:30:08Z

Weaknesses