CVE-2026-80608

A flaw was found in the Linux kernel. This vulnerability, located in the accel/amdxdna component, is a use-after-free issue. It occurs due to a race condition during device removal when force_iova mode is enabled, where a freed memory region can still be accessed. A local attacker could potentially exploit this to cause memory corruption, leading to system instability or a denial of service (DoS).

A moderate use-after-free vulnerability was found in the Linux kernel accel/amdxdna driver, which supports AMD XDNA accelerator devices. When force_iova mode is enabled, the amdxdna_remove() function frees the driver's IOMMU domain (xdna->domain) during device removal. If amdxdna_gem_obj_free() is then called to free a buffer object after the device has already been removed, it may dereference the freed domain, resulting in memory corruption. A local attacker able to trigger this race condition could exploit it to crash the kernel and cause a denial of service (Red Hat CVSS 3.1 score 5.5, Moderate). Red Hat Enterprise Linux (kernel and kernel-rt across the assessed streams) and Red Hat In-Vehicle OS kernels are not affected by this flaw because the vulnerable code is not present in the shipped kernels; every currently assessed product stream has been evaluated as not affected. The upstream CVE.org record scores this flaw 8.8 (Important) with scope changed and high confidentiality and integrity impacts, while Red Hat scores it 5.5 (Moderate); the Red Hat severity reflects the local attack vector, the specific AMD XDNA hardware and force_iova configuration prerequisites, and the availability-focused impact of Red Hat's assessment.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.