CVE-2026-72328

Received Received - Intake

Race Condition in Linux Kernel AMD XDNA Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdna_umap lifetime race amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove() before removing the object from abo->mem.umap_list. If aie2_populate_range() runs concurrently, it may obtain a reference to an amdxdna_umap that is being released, leading to a potential use-after-free. Use kref_get_unless_zero() in aie2_populate_range() when acquiring a reference. If the reference count has already dropped to zero, release is in progress and the entry is skipped.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72328

EUVD

EUVD-2026-59227

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*
amd	amdxdna	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's AMD XDNA accelerator driver. It occurs when a function called amdxdna_umap_release() removes an object from a list before properly cleaning it up, allowing another function aie2_populate_range() to access a freed memory object. The fix involves safely checking if the object is still valid before using it.

Detection Guidance

This vulnerability is specific to the Linux kernel's amdxdna driver and requires kernel-level detection. There are no direct network or system commands to detect this issue as it involves a race condition in kernel memory management. Monitoring kernel logs for crashes or errors related to amdxdna or aie2_populate_range may indicate exploitation or issues.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or potential privilege escalation if exploited. Users running affected Linux kernel versions with AMD XDNA accelerators may experience instability or security breaches.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's amdxdna driver, which could lead to memory corruption or crashes. It does not directly affect compliance with GDPR or HIPAA, as those standards focus on data protection and privacy rather than kernel memory management. However, if exploited, it could potentially lead to unauthorized access or data leaks, indirectly impacting compliance.

Mitigation Strategies

Apply the latest Linux kernel patches that include the fix for CVE-2026-72328. If using a distribution with a vulnerable kernel, update to a patched version immediately. Reboot the system after applying the update to ensure the new kernel is active.

Hi! I’m here to help you understand CVE-2026-72328. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70