CVE-2026-98146
Received Received - Intake

Kernel Panic via Flexible Array in AMDXDNA Command Chain

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain struct amdxdna_cmd_chain contains a flexible array annotated with __counted_by(command_count). Since the structure is stored in shared AMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently. If command_count is changed to zero, the bounds check generated from __counted_by may fail and trigger a kernel panic. Remove __counted_by to avoid relying on the userspace-controlled command_count for the flexible array bounds check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98146
EUVD
EUVD-2026-86977

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's amdxdna driver. It involves a structure called amdxdna_cmd_chain that uses a flexible array with a __counted_by annotation for command_count. The issue arises because this structure is stored in shared memory, allowing userspace to modify command_count concurrently. If command_count is set to zero, it can cause a bounds check failure leading to a kernel panic.

Detection Guidance

This vulnerability is specific to the Linux kernel's amdxdna driver and requires kernel-level inspection. Detection involves checking kernel logs for crashes or verifying the presence of the vulnerable driver. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow a local attacker to cause a denial of service by triggering a kernel panic. It may lead to system crashes or instability if exploited.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. Avoid using the amdxdna driver if possible until the patch is applied. Monitor kernel logs for crashes that may indicate exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98146. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart