CVE-2026-72328
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Fix potential amdxdna_umap lifetime race
amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove() before removing the object from abo->mem.umap_list. If aie2_populate_range() runs concurrently, it may obtain a reference to an amdxdna_umap that is being released, leading to a potential use-after-free.
Use kref_get_unless_zero() in aie2_populate_range() when acquiring a reference. If the reference count has already dropped to zero, release is in progress and the entry is skipped.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | e486147c912f653ef4b60a6c7dbd4168a4c56a9f < 267809e2c56fbea486f7250c8a4acddcc3c54dc5 | affected |
| Linux | Linux | e486147c912f653ef4b60a6c7dbd4168a4c56a9f < 91e8109ecffb925b6202d2737384df285b195bfb | affected |
| Linux | Linux | e486147c912f653ef4b60a6c7dbd4168a4c56a9f < 14f172eff9c19f8043a9858845f33cd034f3a41e | affected |
| Linux | Linux | 6.16 | affected |
| Linux | Linux | 0 < 6.16 | unaffected |
| Linux | Linux | 6.18.40 <= 6.18.* | unaffected |
| Linux | Linux | 7.1.5 <= 7.1.* | unaffected |
| Linux | Linux | 7.2 <= * | unaffected |
Weaknesses
References
- https://git.kernel.org/stable/c/267809e2c56fbea486f7250c8a4acddcc3c54dc5
- https://git.kernel.org/stable/c/91e8109ecffb925b6202d2737384df285b195bfb
- https://git.kernel.org/stable/c/14f172eff9c19f8043a9858845f33cd034f3a41e
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.