CVE-2026-98144

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: put the chained BO when its mapping fails

amdxdna_cmd_set_error() looks up the first BO of a command chain, which

takes a reference, and drops it at the end of the function. The mapping of

that BO is established in between, and the failure path returns without the

put, so the reference is leaked.

Ordinary use does not reach it. The chain has been submitted before any of

this runs, so aie2_cmdlist_fill_slot() has already called

amdxdna_cmd_get_op() on that BO and amdxdna_gem_vmap() has cached its

address. What makes it reachable is that the BO is resolved again by

handle here, and the handle is userspace's to recycle: closing it after

submission and importing a dma-buf whose exporter implements no vmap onto

the same id leaves amdxdna_gem_get_obj() returning an object this cannot

map, since prime_import() types every import AMDXDNA_BO_SHARE.

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References