The vulnerability of the amdxdna_ubuf_map() function in the drivers/accel/amdxdna/amdxdna_ubuf.c driver for Linux kernel-based computing devices allows a hacker to induce a system failure.

The vulnerability of the amdxdnaubufmap function in the drivers/accel/amdxdna/amdxdnaubuf.c driver for Linux kernel-based computing devices involves improper memory release memory leak. Exploiting this vulnerability allows a remote attacker to cause system failures...

SUSE CVE-2026-98146

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

SUSE CVE-2026-98144

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdnacmdseterror looks up the first BO of a command chain, which takes a reference, and drops it at the end of the function. The mapping of that BO is established in...

SUSE CVE-2026-98145

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

CVE-2026-98145

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

CVE-2026-98146

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

DEBIAN-CVE-2026-98146

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

DEBIAN-CVE-2026-98145

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

DEBIAN-CVE-2026-98144

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdnacmdseterror looks up the first BO of a command chain, which takes a reference, and drops it at the end of the function. The mapping of that BO is established in...

CVE-2026-98144

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdnacmdseterror looks up the first BO of a command chain, which takes a reference, and drops it at the end of the function. The mapping of that BO is established in...

UBUNTU-CVE-2026-98144

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdnacmdseterror looks up the first BO of a command chain, which takes a reference, and drops it at the end of the function. The mapping of that BO is established in...

UBUNTU-CVE-2026-98145

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

UBUNTU-CVE-2026-98146

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

CVE-2026-98146

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

EUVD-2026-86977

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

CVE-2026-98146

The Linux kernel contains a vulnerability in the accel/amdxdna component. The struct amdxdna_cmd_chain utilizes a flexible array annotated with __counted_by(command_count). Because this structure resides in shared AMDXDNA_BO_SHARE memory, userspace can concurrently modify command_count. If an att...

CVE-2026-98146 accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

CVE-2026-98146 accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

CVE-2026-98145 accel/amdxdna: reject a command chain that carries no commands

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

EUVD-2026-86976

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...