{"id":"CVE-2026-89978","revision":"66e8b8a02b384d66880f6dd206740746","records":[{"revision":"66e8b8a02b384d66880f6dd206740746","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89978","aliases":[],"title":"accel/amdxdna: return early from a zero-length flush","description":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: return early from a zero-length flush\n\nSYNC_BO does not constrain its size, so a request for zero bytes reaches\ndrm_clflush_virt_range(), which ends with an unconditional\nclflushopt(end - 1). For an empty range that is the byte before the\nmapping, and abo->mem.kva comes from vmap(), so the access lands in the\nguard page below the vmalloc area and faults:\n\n  BUG: unable to handle page fault for address: ffffd16fbbc70fff\n  #PF: supervisor read access in kernel mode\n  Oops: Oops: 0000 [#1] SMP NOPTI\n  CPU: 7 UID: 1000 Comm: sync_bo_probe\n  RIP: 0010:drm_clflush_virt_range+0x3c/0x70\n  Call Trace:\n   amdxdna_drm_sync_bo_ioctl+0x124/0x430 [amdxdna]\n   drm_ioctl+0x301/0x4c0\n   __x64_sys_ioctl+0x115/0x2f0\n   do_syscall_64+0xa6/0x3d0\n\nAny process that can open the render node can do this. Reproduced 3 of 3\ntimes on a Strix Point NPU (1022:17f0), by calling SYNC_BO with size 0 on\nan AMDXDNA_BO_SHARE object. The import arm takes the same request but\nflushes the whole scatterlist, so it survives it.\n\nNothing needs flushing for an empty range, so answer before choosing a\npath.","state":0,"publishedAt":"2026-09-16T10:32:55.928+00:00","modifiedAt":"2026-10-19T08:55:52.997+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/accel/amdxdna/amdxdna_gem.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e252e3f3488a49267e08ea7d972ac5ba3f2f1763\",\n                            \"lessThan\": \"45962da5821d0a691f638ccb13842889156d8969\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e252e3f3488a49267e08ea7d972ac5ba3f2f1763\",\n                            \"lessThan\": \"f00def884a831dc49eb659dac2dd09dbfd21e67f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e252e3f3488a49267e08ea7d972ac5ba3f2f1763\",\n                            \"lessThan\": \"dc14753664240cedf669623b27ae9922b0618b25\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/accel/amdxdna/amdxdna_gem.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.17\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.17\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/45962da5821d0a691f638ccb13842889156d8969","https://git.kernel.org/stable/c/f00def884a831dc49eb659dac2dd09dbfd21e67f","https://git.kernel.org/stable/c/dc14753664240cedf669623b27ae9922b0618b25"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89978","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89978","identifiers":["CVE-2026-89978"]},"retained":false,"historicalAffected":[]}],"coverage":[]}