CVE-2026-72093

Received Received - Intake

Use-After-Free in Linux Kernel AMDXDNA Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap() When vm_insert_pages() fails, the error path calls vma->vm_ops->close(vma) which internally calls drm_gem_vm_close() → drm_gem_object_put(), releasing the GEM object reference acquired at the start of the function. However, the close_vma label then falls through to put_obj, which calls drm_gem_object_put() a second time on the same object. If the first put releases the last reference, the object is freed and the second put accesses freed memory, causing a use-after-free. Fix by returning directly from close_vma instead of falling through to put_obj, since the close handler already performs all necessary cleanup including the object put.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72093

EUVD

EUVD-2026-59051

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's AMD XDNA accelerator driver. When mapping a DMA buffer fails, the cleanup code incorrectly calls the memory release function twice. The first call frees the object, and the second call tries to access the already freed memory, causing a use-after-free error.

Detection Guidance

This vulnerability is specific to the Linux kernel's amdxdna driver and requires kernel-level inspection. Detection involves checking kernel logs for use-after-free errors or crashes related to the amdxdna module. Commands like dmesg | grep amdxdna or journalctl -k | grep amdxdna may reveal issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a kernel crash or execute arbitrary code with elevated privileges. It may lead to system instability, data corruption, or unauthorized access depending on the attacker's goals and system configuration.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a low-level kernel memory management issue. Compliance impacts would depend on how the affected system is used rather than the vulnerability itself.

Mitigation Strategies

Immediately update your Linux kernel to a version containing the fix for CVE-2026-72093. If updating is not possible, disable the amdxdna module by running rmmod amdxdna or blacklisting it in /etc/modprobe.d/. Monitor kernel logs for signs of exploitation or crashes.

Hi! I’m here to help you understand CVE-2026-72093. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70