CVE-2026-74721

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74721", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.929Z", "datePublished": "2026-08-22T15:33:13.960Z", "dateUpdated": "2026-10-15T10:09:24.790Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-15T10:09:24.790Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()\n\nTwo error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma)\nbefore returning an error code to the caller. This is incorrect:\namdxdna_gem_obj_mmap() registers an HMM interval notifier before calling\namdxdna_insert_pages(), and on a hard error it jumps to hmm_unreg to undo\nthat registration. Calling vm_ops->close() manually \u2014 which drops the\nshmem pages_pin_count and the GEM object reference that backs the VMA \u2014\nbefore the mmap syscall has even returned causes those resources to be\nreleased while the VMA is still alive. The kernel VMA teardown will call\nvm_ops->close() a second time when the process later unmaps the range,\nproducing a reference count underflow.\n\nReplace both hard-error returns with a deferred-fault approach that keeps\nthe VMA alive and retries page insertion through the HMM range-fault path."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires a local mmap() on an AMD XDNA GEM buffer through /dev/accel/accel* after DRM_IOCTL_AMDXDNA_CREATE_BO; amdxdna_insert_pages() is only reached from drm_gem_mmap\u2192amdxdna_gem_obj_mmap with no network, adjacent-radio, or physical-bus entry point.\nAC:L - On affected Ryzen AI systems the attacker opens the accel node, creates a buffer, and mmap()s it; vm_insert_pages() or handle_mm_fault() failures are reliably forced via RLIMIT_AS/cgroup memory pressure, deterministically hitting vma->vm_ops->close() before failed-mmap VMA teardown invokes close again.\nPR:L - AMDXDNA_CREATE_BO and GEM mmap use ioctl flags 0 (no DRM_ROOT_ONLY/DRM_AUTH); any unprivileged local user allowed to open /dev/accel/accel* (typically render/video group) can reach the bug without real root or init-namespace capabilities.\nUI:N - The attacker opens the accel device, allocates a GEM object, and mmap()s it in their own process; no separate victim mount, file open, or other user interaction beyond the attacker's own syscalls is required.\nS:U - Premature vma->vm_ops->close() double-frees shmem pages_use_count and drm_gem_object references inside kernel DRM/GEM memory management; impact stays within the kernel security authority and is not a VM escape, hypervisor breakout, or IOMMU DMA-boundary bypass.\nC:H - Double close releases backing shmem pages and GEM metadata while the VMA remains live until mmap teardown; refcount underflow creates use-after-free conditions that heap grooming can turn into arbitrary kernel memory disclosure beyond a bounded leak.\nI:H - The erroneous second close corrupts slab/refcount state on freed GEM objects and backing pages, providing primitives developable into arbitrary kernel writes and local privilege escalation rather than merely limited data modification.\nA:H - refcount_t underflow and use-after-free in drm_gem_shmem_vm_close() and drm_gem_object_put() can immediately kernel-oops or panic the host; repeated mmap-trigger attempts sustain denial of service on affected AMD NPU systems."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/accel/amdxdna/amdxdna_gem.c"], "versions": [{"version": "e486147c912f653ef4b60a6c7dbd4168a4c56a9f", "lessThan": "b3d05a335cbd3d89538e9dde1621dccf33ae945a", "status": "affected", "versionType": "git"}, {"version": "e486147c912f653ef4b60a6c7dbd4168a4c56a9f", "lessThan": "1501e4d07c6fee0d50531a0d1cb2be01a63e6e75", "status": "affected", "versionType": "git"}, {"version": "e486147c912f653ef4b60a6c7dbd4168a4c56a9f", "lessThan": "8d51e0fd3e698919d2adeff71936377f0c0d4aa0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/accel/amdxdna/amdxdna_gem.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b3d05a335cbd3d89538e9dde1621dccf33ae945a"}, {"url": "https://git.kernel.org/stable/c/1501e4d07c6fee0d50531a0d1cb2be01a63e6e75"}, {"url": "https://git.kernel.org/stable/c/8d51e0fd3e698919d2adeff71936377f0c0d4aa0"}], "title": "accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/accel/amdxdna/amdxdna_gem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b3d05a335cbd3d89538e9dde1621dccf33ae945a", "status": "affected", "version": "e486147c912f653ef4b60a6c7dbd4168a4c56a9f", "versionType": "git"}, {"lessThan": "1501e4d07c6fee0d50531a0d1cb2be01a63e6e75", "status": "affected", "version": "e486147c912f653ef4b60a6c7dbd4168a4c56a9f", "versionType": "git"}, {"lessThan": "8d51e0fd3e698919d2adeff71936377f0c0d4aa0", "status": "affected", "version": "e486147c912f653ef4b60a6c7dbd4168a4c56a9f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/accel/amdxdna/amdxdna_gem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()\n\nTwo error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma)\nbefore returning an error code to the caller. This is incorrect:\namdxdna_gem_obj_mmap() registers an HMM interval notifier before calling\namdxdna_insert_pages(), and on a hard error it jumps to hmm_unreg to undo\nthat registration. Calling vm_ops->close() manually \u2014 which drops the\nshmem pages_pin_count and the GEM object reference that backs the VMA \u2014\nbefore the mmap syscall has even returned causes those resources to be\nreleased while the VMA is still alive. The kernel VMA teardown will call\nvm_ops->close() a second time when the process later unmaps the range,\nproducing a reference count underflow.\n\nReplace both hard-error returns with a deferred-fault approach that keeps\nthe VMA alive and retries page insertion through the HMM range-fault path."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\naccel/amxdna: Corrige errores de inserci\u00f3n de p\u00e1gina en amdxdna_insert_pages()\n\nDos rutas de error en amdxdna_insert_pages() llamaron a vma -> vm_ops -> close(vma) antes de devolver un c\u00f3digo de error al llamador. Esto es incorrecto: amdxdna_gem_obj_mmap() registra un notificador de intervalo HMM antes de llamar a amdxdna_insert_pages(), y en un error grave salta a hmm_unreg para deshacer ese registro. Llamar a vm_ops -> close() manualmente - lo que reduce el pages_pin_count de shmem y la referencia al objeto GEM que respalda el VMA - antes de que la llamada al sistema mmap haya siquiera regresado hace que esos recursos sean liberados mientras el VMA a\u00fan est\u00e1 activo. La desestructuraci\u00f3n del VMA del kernel llamar\u00e1 a vm_ops -> close() una segunda vez cuando el proceso desmapee el rango m\u00e1s tarde, produciendo un desbordamiento negativo del contador de referencias.\n\nReemplaza ambas devoluciones de error grave con un enfoque de fallo diferido que mantiene el VMA activo y reintenta la inserci\u00f3n de p\u00e1gina a trav\u00e9s de la ruta de fallo de rango HMM."}], "id": "CVE-2026-74721", "lastModified": "2026-10-15T11:17:48.843", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-22T16:16:47.080", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1501e4d07c6fee0d50531a0d1cb2be01a63e6e75"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8d51e0fd3e698919d2adeff71936377f0c0d4aa0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b3d05a335cbd3d89538e9dde1621dccf33ae945a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()", "id": "2521458", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521458"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\naccel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()\nTwo error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma)\nbefore returning an error code to the caller. This is incorrect:\namdxdna_gem_obj_mmap() registers an HMM interval notifier before calling\namdxdna_insert_pages(), and on a hard error it jumps to hmm_unreg to undo\nthat registration. Calling vm_ops->close() manually \u2014 which drops the\nshmem pages_pin_count and the GEM object reference that backs the VMA \u2014\nbefore the mmap syscall has even returned causes those resources to be\nreleased while the VMA is still alive. The kernel VMA teardown will call\nvm_ops->close() a second time when the process later unmaps the range,\nproducing a reference count underflow.\nReplace both hard-error returns with a deferred-fault approach that keeps\nthe VMA alive and retries page insertion through the HMM range-fault path.", "A flaw was found in the Linux kernel's `accel/amxdna` component. Specifically, an error in the `amdxdna_insert_pages()` function causes system resources to be released too early. This premature release can lead to a critical error when the system later attempts to free the same resources, resulting in a reference count underflow. This vulnerability could allow a local attacker to cause the system to crash, leading to a denial of service."], "name": "CVE-2026-74721", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74721\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74721\nhttps://lore.kernel.org/linux-cve-announce/2026082240-CVE-2026-74721-18a0@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e486147c912f653ef4b60a6c7dbd4168a4c56a9f,1501e4d07c6fee0d50531a0d1cb2be01a63e6e75)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e486147c912f653ef4b60a6c7dbd4168a4c56a9f,8d51e0fd3e698919d2adeff71936377f0c0d4aa0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T19:00:14.810036+00:00", "updated": "2026-08-25T17:45:04.931708+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}