CVE-2026-98145 accel/amdxdna: reject a command chain that carries no commands

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

CVE-2026-98144

A memory leak vulnerability exists in the Linux kernel within the accel/amdxdna component. The amdxdna_cmd_set_error() function takes a reference to the first BO of a command chain and intends to drop it at the end of the function. However, a failure path during the mapping process returns early ...

CVE-2026-98145 accel/amdxdna: reject a command chain that carries no commands

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

CVE-2026-98144

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdnacmdseterror looks up the first BO of a command chain, which takes a reference, and drops it at the end of the function. The mapping of that BO is established in...

CVE-2026-98145

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

CVE-2026-98145

The Linux kernel contains a vulnerability in the accel/amdxdna driver where a command chain with a command_count of zero improperly passes payload length checks. Because the struct_size calculation only accounts for the header, the fill loop is skipped, resulting in the submission of a zero-lengt...

EUVD-2026-86976

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

CVE-2026-98144 accel/amdxdna: put the chained BO when its mapping fails

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdnacmdseterror looks up the first BO of a command chain, which takes a reference, and drops it at the end of the function. The mapping of that BO is established in...

CVE-2026-98146

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

CVE-2026-98145: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

CVE-2026-98145

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

CVE-2026-98144: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdnacmdseterror looks up the first BO of a command chain, which takes a reference, and drops it at the end of the function. The mapping of that BO is established in...

CVE-2026-98144

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdnacmdseterror looks up the first BO of a command chain, which takes a reference, and drops it at the end of the function. The mapping of that BO is established in...

CVE-2026-98146: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

Linux Distros Unpatched Vulnerability : CVE-2026-98144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdnacmdseterror looks up the fir...

Linux Distros Unpatched Vulnerability : CVE-2026-98146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the...

Linux Distros Unpatched Vulnerability : CVE-2026-98145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is...

PT-2026-98806

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the amdxdna cmd set error function. The function retrieves the first Buffer Object BO of a command chain, which increments its reference count. If the subseque...

PT-2026-98808

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/amdxdna component where the amdxdna cmd chain structure uses a flexible array annotated with counted bycommand count. Because this structure is stored in...

PT-2026-98807

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/amdxdna component where the system fails to reject command chains that contain no commands. When the command count variable is zero, the payload length check...