7.8

CVE-2026-72093

accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()

When vm_insert_pages() fails, the error path calls vma->vm_ops->close(vma)
which internally calls drm_gem_vm_close() → drm_gem_object_put(),
releasing the GEM object reference acquired at the start of the function.
However, the close_vma label then falls through to put_obj, which calls
drm_gem_object_put() a second time on the same object.

If the first put releases the last reference, the object is freed and the
second put accesses freed memory, causing a use-after-free.

Fix by returning directly from close_vma instead of falling through to
put_obj, since the close handler already performs all necessary cleanup
including the object put.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version e486147c912f653ef4b60a6c7dbd4168a4c56a9f
Version < 4e370b5289624f46a356dcc94f9f87025eaa6036
Status affected
Version e486147c912f653ef4b60a6c7dbd4168a4c56a9f
Version < 5da885c39baa70f570a8be35a78e85a351f33918
Status affected
Version e486147c912f653ef4b60a6c7dbd4168a4c56a9f
Version < 63bbf9ac5dde2ba85e7b39d0a0b7d540e6252ba4
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.16
Status affected
Version 0
Version < 6.16
Status unaffected
Version <= 6.18.*
Version 6.18.40
Status unaffected
Version <= 7.1.*
Version 7.1.5
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.066
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/4e370b5289624f46a356dcc94f9f87025eaa6036
https://git.kernel.org/stable/c/5da885c39baa70f570a8be35a78e85a351f33918
https://git.kernel.org/stable/c/63bbf9ac5dde2ba85e7b39d0a0b7d540e6252ba4