CVE-2026-72331

A flaw was found in the accel/amdxdna component of the Linux kernel. The aie2_populate_range() and amdxdna_umap_release() functions access a saved Virtual Memory Area (VMA) pointer that may have already been freed. This race condition can lead to a use-after-free vulnerability, which could result in system instability or potentially allow a local attacker to escalate privileges.

A moderate-impact use-after-free flaw was found in the Linux kernel accel/amdxdna driver. The aie2_populate_range() and amdxdna_umap_release() functions access a saved Virtual Memory Area (VMA) pointer that may already have been freed due to a race condition. A local user with access to an affected device could potentially trigger this use-after-free, causing system instability or a kernel crash. Red Hat assessed this flaw as having moderate impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), limited to availability, whereas the upstream CVE record assigns a higher score (7.8) that assumes full confidentiality, integrity, and availability impact. The vulnerable code is not present in the Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernels shipped by Red Hat, so all Red Hat products are currently marked as not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.