CVE-2026-72090
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdna_drm_sync_bo_ioctl() looks up args->handle in the ioctl caller's drm_file. For SYNC_DIRECT_FROM_DEVICE, it then calls amdxdna_hwctx_sync_debug_bo(), but passes abo->client. amdxdna_hwctx_sync_debug_bo() uses the passed client both as the handle namespace for debug_bo_hdl and as the owner of the hardware context xarray. Those must match the file that supplied args->handle. The BO's stored client pointer is object state, not the ioctl context. Pass filp->driver_priv instead, matching the original handle lookup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72090
EUVD
EUVD-2026-59048

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of buffer object synchronization in the amdxdna driver. The issue occurs when the function amdxdna_drm_sync_bo_ioctl() passes the wrong client pointer to amdxdna_hwctx_sync_debug_bo(), leading to a mismatch between the handle namespace and hardware context ownership.

Detection Guidance

This vulnerability is specific to the Linux kernel's amdxdna driver and requires kernel-level inspection. Detection involves checking kernel logs for errors related to amdxdna_drm_sync_bo_ioctl or debug BO sync operations. Use commands like dmesg | grep amdxdna or journalctl -k | grep amdxdna to identify suspicious activity.

Impact Analysis

This vulnerability could allow unauthorized access or manipulation of kernel memory, potentially leading to system crashes, privilege escalation, or data corruption. It specifically affects systems using the amdxdna driver for AMD accelerators.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch this vulnerability. If immediate patching is not possible, consider disabling the amdxdna module temporarily using modprobe -r amdxdna. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72090. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart