HIGH Introduced in 6.16
amxdna PageInsert UAF
CVE-2026-74721
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages() Two error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma) before returning an error code to the caller. This is incorrect: amdxdna_gem_obj_mmap() registers an HMM interval notifier before calling amdxdna_insert_pages(), and on a hard error it jumps to hmm_unreg to undo that registration. Calling vm_ops->close() manually — which drops the shmem pages_pin_count and the GEM object reference that backs the VMA — before the mmap syscall has even returned causes those resources to be released while the VMA is still alive. The kernel VMA teardown will call vm_ops->close() a second time when the process later unmaps the range, producing a reference count underflow. Replace both hard-error returns with a deferred-fault approach that keeps the VMA alive and retries page insertion through the HMM range-fault path.
02KernelScan AI Analysis
Risk summary
A local user with access to an AMD XDNA accelerator device node can trigger a double-close of a VMA's vm_ops, causing a reference count underflow on the backing GEM object and shmem pages. This leads to use-after-free conditions exploitable for kernel memory corruption, privilege escalation, or denial of service. The vulnerability requires specific AMD XDNA hardware to be present and accessible.
Vulnerability analysis
When mapping a GEM buffer object from the AMD XDNA accelerator driver, the page-insertion routine can fail on two error paths. On failure, the code manually invokes the VMA's close operation, which drops reference counts on the backing shmem pages and GEM object. Because the mmap syscall has not yet returned, the VMA is still alive, and the kernel's normal VMA teardown will call close a second time when the process later unmaps the range. This double-close produces a reference count underflow that frees resources while they are still in use, creating a use-after-free condition. The fix replaces both premature close calls with a deferred-fault approach: the mapping is marked invalid and page insertion is retried later through the HMM range-fault path, keeping the VMA alive and avoiding the double-close entirely. This is reachable from any local process that can open and mmap the AMD XDNA accelerator device node, which typically requires only group-level device permissions rather than root.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.16 | 6.18.57 | b3d05a335cbd |
| 7.1 | 6.16 | 7.1.9 | 1501e4d07c6f |
| mainline | 6.16 | 7.2 | 8d51e0fd3e69 |