CVE-2026-74716
Received Received - Intake

Memory Corruption in Linux Kernel AMD XDNA Driver

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages() In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears VM_PFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls madvise(MADV_DONTNEED), the PTEs will be successfully cleared because VM_MIXEDMAP allows this (unlike VM_PFNMAP). When userspace subsequently accesses the memory, drm_gem_shmem_fault() handles the page fault and attempts to map the backing shmem page via vmf_insert_pfn() which calls vmf_insert_pfn_prot(). Because the backing shmem page is normal system memory (pfn_valid(pfn) is true) and the VMA now has VM_MIXEDMAP set, won't this predictably trigger the explicit assertion BUG_ON((vma->vm_flags & VM_MIXEDMAP) && pfn_valid(pfn)) Fix by removing the vm_flags_mod() call and replacing the vm_insert_pages() pre-population with the handle_mm_fault() loop that was already used for the import (dma-buf) path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74716
EUVD
EUVD-2026-64403

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the amdxdna driver where a BUG_ON assertion could be triggered by a local unprivileged user. The issue occurs when a userspace process mmaps a non-imported GEM object, calls madvise(MADV_DONTNEED), then accesses the memory causing a page fault. The kernel incorrectly allows this sequence due to VM_MIXEDMAP flags, leading to a predictable crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's amdxdna driver and requires kernel-level detection. Check if your kernel version includes the vulnerable code by examining the amdxdna driver source or logs for BUG_ON triggers related to VM_MIXEDMAP and pfn_valid. No direct network detection commands are applicable.

Impact Analysis

An unprivileged local attacker could exploit this to crash the system by triggering a kernel BUG_ON, causing a denial of service. The vulnerability does not appear to allow privilege escalation or data theft based on the provided description.

Mitigation Strategies

Apply the kernel patch that removes the vm_flags_mod() call in amdxdna_insert_pages(). Update to a Linux kernel version that includes the fix. If immediate patching is not possible, restrict access to the amdxdna driver or disable it until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74716. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart