{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80608","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-26T14:34:25.773Z","datePublished":"2026-08-28T06:48:32.152Z","dateUpdated":"2026-08-29T06:21:18.093Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-29T06:21:18.093Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Fix iommu domain lifetime race during device removal\n\nWhen force_iova mode is enabled, amdxdna_remove() frees xdna->domain. If\namdxdna_gem_obj_free() is called after device removal, it may attempt to\naccess xdna->domain, resulting in a use-after-free.\n\nFix the race by adding freeing xdna->domain as a managed release action,\nso its lifetime is managed by DRM and remains valid until all managed\nresources are released."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is reached via local /dev/accel/accel* syscalls (open, DRM_IOCTL_AMDXDNA_CREATE_BO, close) that call amdxdna_gem_obj_free()→amdxdna_dma_unmap_bo(); there is no network, adjacent-radio, or physical-bus entry to this AMD XDNA NPU driver path.\nAC:L - This is a lifetime race between amdxdna_remove() freeing xdna->domain and concurrent GEM teardown; an attacker controls both sides with threads holding DMA-mapped BOs while triggering driver unbind/rmmod or rapid create/destroy ioctls, reliably hitting the post-removal amdxdna_dma_unmap_bo() UAF window.\nPR:L - Vulnerable ioctls use DRM_IOCTL_DEF_DRV flags 0 (no DRM_ROOT_ONLY/DRM_AUTH); any local user permitted to open the AMD NPU accel device on Ryzen AI systems can create IOVA-mapped BOs and race teardown, without init-namespace root, once force_iova mode is active.\nUI:N - Exploitation requires only the attacker opening the accel device, allocating buffer objects, and closing/releasing them (or duping fds) during driver removal; no separate victim mount, click, or other user interaction is needed.\nS:C - The use-after-free dereferences a freed struct iommu_domain during iommu_unmap()/IOVA teardown; corrupting IOMMU mapping state can break DMA isolation between the NPU and host physical memory, crossing the IOMMU security boundary.\nC:H - Use-after-free of the IOMMU domain object and associated iovad metadata via amdxdna_dma_unmap_bo() enables attacker-influenced slab reuse; subsequent iommu_unmap and IOVA allocator dereferences provide arbitrary kernel memory disclosure primitives.\nI:H - UAF on the IOMMU domain during unmap enables heap grooming to corrupt IOMMU page-table management structures and kernel objects, supporting arbitrary kernel writes, control-flow hijack, and potential redirection of NPU DMA to attacker-chosen pages.\nA:H - Dereferencing and operating on a freed iommu_domain in amdxdna_dma_unmap_bo() causes kernel oops/panic; the race is repeatable whenever GEM objects outlive amdxdna_iommu_fini() during device removal, sustaining denial of service."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/accel/amdxdna/amdxdna_iommu.c"],"versions":[{"version":"ece3e8980907818c72dc9faa7bbaf40488ef1824","lessThan":"65e7e2b8d71b418439ebc68e80ed3e5a325375d6","status":"affected","versionType":"git"},{"version":"ece3e8980907818c72dc9faa7bbaf40488ef1824","lessThan":"b4a0500fdf6e61a6c5f92ff2e61bc91578075803","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/accel/amdxdna/amdxdna_iommu.c"],"versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/65e7e2b8d71b418439ebc68e80ed3e5a325375d6"},{"url":"https://git.kernel.org/stable/c/b4a0500fdf6e61a6c5f92ff2e61bc91578075803"}],"title":"accel/amdxdna: Fix iommu domain lifetime race during device removal","x_generator":{"engine":"bippy-1.2.0"}}}}