CVE-2026-98146

Analyzed Analyzed - Analysis Complete

Kernel Panic via Flexible Array in AMDXDNA Command Chain

Publication date: 2026-09-25

Last updated on: 2026-10-22

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain struct amdxdna_cmd_chain contains a flexible array annotated with __counted_by(command_count). Since the structure is stored in shared AMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently. If command_count is changed to zero, the bounds check generated from __counted_by may fail and trigger a kernel panic. Remove __counted_by to avoid relying on the userspace-controlled command_count for the flexible array bounds check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-22

Generated

2026-11-08

AI Q&A

2026-09-25

EPSS Evaluated

2026-11-07

NVD

CVE-2026-98146

EUVD

EUVD-2026-86977

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.2.7 (exc)
linux	linux_kernel	7.3
linux	linux_kernel	From 6.14 (inc) to 6.18.53 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's amdxdna driver. It involves a structure called amdxdna_cmd_chain that uses a flexible array with a __counted_by annotation for command_count. The issue arises because this structure is stored in shared memory, allowing userspace to modify command_count concurrently. If command_count is set to zero, it can cause a bounds check failure leading to a kernel panic.

Detection Guidance

This vulnerability is specific to the Linux kernel's amdxdna driver and requires kernel-level inspection. Detection involves checking kernel logs for crashes or verifying the presence of the vulnerable driver. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow a local attacker to cause a denial of service by triggering a kernel panic. It may lead to system crashes or instability if exploited.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by enabling kernel panics through userspace manipulation of command_count in shared memory. Such instability may lead to denial-of-service conditions, affecting data availability and integrity required by these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. Avoid using the amdxdna driver if possible until the patch is applied. Monitor kernel logs for crashes that may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-98146. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...