HIGH Introduced in 7.1
amdxdna IommuDomain UAF
CVE-2026-80608
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI5.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix iommu domain lifetime race during device removal When force_iova mode is enabled, amdxdna_remove() frees xdna->domain. If amdxdna_gem_obj_free() is called after device removal, it may attempt to access xdna->domain, resulting in a use-after-free. Fix the race by adding freeing xdna->domain as a managed release action, so its lifetime is managed by DRM and remains valid until all managed resources are released.
02KernelScan AI Analysis
Risk summary
A local user with access to the AMD XDNA accelerator device can trigger a use-after-free of the IOMMU domain during device removal when force_iova mode is enabled. This could lead to kernel memory corruption, potentially allowing privilege escalation or denial of service.
Vulnerability analysis
When a specific optional debugging mode is enabled, the AMD XDNA driver's device-removal path frees the IOMMU domain while memory object cleanup may still be in progress on another thread. This timing gap allows the cleanup path to access the already-freed domain, causing a use-after-free. The fix ensures the domain is released only after all dependent memory objects have been destroyed by tying its lifetime to the driver's managed teardown sequence. The vulnerable path requires that optional mode to be active and access to the accelerator device, which is normally available to a local user with device permissions.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.1 | 7.1 | 7.1.5 | 65e7e2b8d71b |
| mainline | 7.1 | 7.2 | b4a0500fdf6e |