GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72090 (GCVE-0-2026-72090)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-17 05:40
VLAI
Title
accel/amdxdna: Use caller client for debug BO sync
Summary
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdna_drm_sync_bo_ioctl() looks up args->handle in the ioctl caller's drm_file. For SYNC_DIRECT_FROM_DEVICE, it then calls amdxdna_hwctx_sync_debug_bo(), but passes abo->client. amdxdna_hwctx_sync_debug_bo() uses the passed client both as the handle namespace for debug_bo_hdl and as the owner of the hardware context xarray. Those must match the file that supplied args->handle. The BO's stored client pointer is object state, not the ioctl context. Pass filp->driver_priv instead, matching the original handle lookup.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7ea0468380216c10b73633b976d33efa8c12d375 , < 216e43d93dd49ec253052741aa476e51a8c54cd8 (git)
Affected: 7ea0468380216c10b73633b976d33efa8c12d375 , < 7caf2a2351d4053075670ff3e26a6815da0a9e1e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/amdxdna/amdxdna_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "216e43d93dd49ec253052741aa476e51a8c54cd8",
              "status": "affected",
              "version": "7ea0468380216c10b73633b976d33efa8c12d375",
              "versionType": "git"
            },
            {
              "lessThan": "7caf2a2351d4053075670ff3e26a6815da0a9e1e",
              "status": "affected",
              "version": "7ea0468380216c10b73633b976d33efa8c12d375",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/amdxdna/amdxdna_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Use caller client for debug BO sync\n\namdxdna_drm_sync_bo_ioctl() looks up args-\u003ehandle in the ioctl caller\u0027s\ndrm_file. For SYNC_DIRECT_FROM_DEVICE, it then calls\namdxdna_hwctx_sync_debug_bo(), but passes abo-\u003eclient.\n\namdxdna_hwctx_sync_debug_bo() uses the passed client both as the handle\nnamespace for debug_bo_hdl and as the owner of the hardware context xarray.\nThose must match the file that supplied args-\u003ehandle. The BO\u0027s stored\nclient pointer is object state, not the ioctl context.\n\nPass filp-\u003edriver_priv instead, matching the original handle lookup."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires DRM_IOCTL_AMDXDNA_SYNC_BO via ioctl on the local AMD XDNA accel node (/dev/accel/accel*); amdxdna has no network, Bluetooth, or physical-bus entry to amdxdna_drm_sync_bo_ioctl() or amdxdna_hwctx_sync_debug_bo().\nAC:L - An attacker with two DRM clients can share debug buffer objects via dma-buf and issue SYNC_DIRECT_FROM_DEVICE to force abo-\u003eclient != filp-\u003edriver_priv; handle-index collisions in the victim client\u0027s namespace are attacker-influencable without uncontrollable timing or layout.\nPR:L - AMDXDNA_SYNC_BO is registered without DRM_ROOT_ONLY; any unprivileged local user permitted to open the AMD NPU accel device (typically via render/video group on Ryzen AI laptops or cloud NPU guests) can reach the bug without real root.\nUI:N - No victim interaction is required; a local attacker can open the accel device, create or import buffer objects, and trigger SYNC_DIRECT_FROM_DEVICE from their own process or a second cooperating local client in typical multi-process ML workloads.\nS:U - The flaw causes cross-DRM-client handle-namespace and hwctx confusion within the same kernel on one host; it does not cross VM, hypervisor, IOMMU, or SR-IOV security boundaries into another authority.\nC:H - Passing abo-\u003eclient re-resolves the ioctl handle in another client\u0027s drm_file and hwctx xarray, so SYNC_DEBUG_BO can DMA firmware debug data from a victim hwctx into attacker-mapped or attacker-chosen device memory, disclosing cross-context NPU/firmware contents.\nI:H - Mismatched client/handle resolution can bind SYNC_DEBUG_BO to the wrong hwctx and BO, directing firmware device-to-host DMA sync to incorrect device-heap offsets and corrupting another client\u0027s NPU buffer allocations or metadata.\nA:H - Erroneous cross-context firmware mailbox sync on an invalid or foreign hwctx can fault driver error paths, hang the mailbox channel, or destabilize the NPU stack, denying accelerator service to local workloads on the affected host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:40:10.207Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/216e43d93dd49ec253052741aa476e51a8c54cd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/7caf2a2351d4053075670ff3e26a6815da0a9e1e"
        }
      ],
      "title": "accel/amdxdna: Use caller client for debug BO sync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72090",
    "datePublished": "2026-08-15T05:52:37.524Z",
    "dateReserved": "2026-08-09T03:40:39.905Z",
    "dateUpdated": "2026-08-17T05:40:10.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72090",
      "date": "2026-09-04",
      "epss": "0.00154",
      "percentile": "0.04826"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72090\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:23.077\",\"lastModified\":\"2026-08-17T06:18:07.947\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\naccel/amdxdna: Use caller client for debug BO sync\\n\\namdxdna_drm_sync_bo_ioctl() looks up args-\u003ehandle in the ioctl caller\u0027s\\ndrm_file. For SYNC_DIRECT_FROM_DEVICE, it then calls\\namdxdna_hwctx_sync_debug_bo(), but passes abo-\u003eclient.\\n\\namdxdna_hwctx_sync_debug_bo() uses the passed client both as the handle\\nnamespace for debug_bo_hdl and as the owner of the hardware context xarray.\\nThose must match the file that supplied args-\u003ehandle. The BO\u0027s stored\\nclient pointer is object state, not the ioctl context.\\n\\nPass filp-\u003edriver_priv instead, matching the original handle lookup.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/accel/amdxdna/amdxdna_gem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7ea0468380216c10b73633b976d33efa8c12d375\",\"lessThan\":\"216e43d93dd49ec253052741aa476e51a8c54cd8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7ea0468380216c10b73633b976d33efa8c12d375\",\"lessThan\":\"7caf2a2351d4053075670ff3e26a6815da0a9e1e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/accel/amdxdna/amdxdna_gem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/216e43d93dd49ec253052741aa476e51a8c54cd8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7caf2a2351d4053075670ff3e26a6815da0a9e1e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T21:42:49+00:00",
      "cve": "CVE-2026-72090",
      "id": "CVE-2026-72090",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: accel/amdxdna: Use caller client for debug BO sync",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72090.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.