CVE-2026-74721

A flaw was found in the Linux kernel's accel/amxdna component. Specifically, an error in the amdxdna_insert_pages() function causes system resources to be released too early. This premature release can lead to a critical error when the system later attempts to free the same resources, resulting in a reference count underflow. This vulnerability could allow a local attacker to cause the system to crash, leading to a denial of service.

A reference lifetime bug in amdxdna_insert_pages() can release VMA backed resources before the mmap syscall has returned. The failing error paths manually call vm_ops close while the VMA remains alive, dropping shmem pages_pin_count and the GEM object reference that backs the mapping. When the process later unmaps the range, normal VMA teardown can call close again and produce a refcount underflow, which is a use after free candidate rather than a simple warning. The issue is not network reachable. Impact is at least local denial of service via kernel crash and in the paranoid case may allow confidentiality and integrity impact due to memory lifetime corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.