CVE-2026-72328
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel's accel/amdxdna module, there is a race condition in amdxdna_umap_release() that can lead to use-after-free when aie2_populate_range() runs concurrently.
Risk Assessment
Potential system crash or unauthorized memory access due to a race in the accelerator driver.
Recommendation
Apply a Linux kernel update containing the fix that uses kref_get_unless_zero() for safe reference acquisition.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdna_umap lifetime race amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove() before removing the object from abo->mem.umap_list. If aie2_populate_range() runs concurrently, it may obtain a reference to an amdxdna_umap that is being released, leading to a potential use-after-free. Use kref_get_unless_zero() in aie2_populate_range() when acquiring a reference. If the reference count has already dropped to zero, release is in progress and the entry is skipped.