CVE-2026-89978
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: return early from a zero-length flush
SYNC_BO does not constrain its size, so a request for zero bytes reaches drm_clflush_virt_range(), which ends with an unconditional clflushopt(end - 1). For an empty range that is the byte before the mapping, and abo->mem.kva comes from vmap(), so the access lands in the guard page below the vmalloc area and faults:
Any process that can open the render node can do this. Reproduced 3 of 3 times on a Strix Point NPU (1022:17f0), by calling SYNC_BO with size 0 on an AMDXDNA_BO_SHARE object. The import arm takes the same request but flushes the whole scatterlist, so it survives it.
Leer descripción completaMostrar menos
Nothing needs flushing for an empty range, so answer before choosing a path.
Detalles técnicos trazas, registros y código del informe original
BUG: unable to handle page fault for address: ffffd16fbbc70fff #PF: supervisor read access in kernel mode Oops: Oops: 0000 [#1] SMP NOPTI CPU: 7 UID: 1000 Comm: sync_bo_probe RIP: 0010:drm_clflush_virt_range+0x3c/0x70 Call Trace: amdxdna_drm_sync_bo_ioctl+0x124/0x430 [amdxdna] drm_ioctl+0x301/0x4c0 __x64_sys_ioctl+0x115/0x2f0 do_syscall_64+0xa6/0x3d0
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 10
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-89978",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "e252e3f3488a49267e08ea7d972ac5ba3f2f1763",
"lessThan": "45962da5821d0a691f638ccb13842889156d8969",
"versionType": "git"
},
{
"status": "affected",
"version": "e252e3f3488a49267e08ea7d972ac5ba3f2f1763",
"lessThan": "f00def884a831dc49eb659dac2dd09dbfd21e67f",
"versionType": "git"
},
{
"status": "affected",
"version": "e252e3f3488a49267e08ea7d972ac5ba3f2f1763",
"lessThan": "dc14753664240cedf669623b27ae9922b0618b25",
"versionType": "git"
}
],
"programFiles": [
"drivers/accel/amdxdna/amdxdna_gem.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/accel/amdxdna/amdxdna_gem.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-09-16T11:17:08.667",
"references": [
{
"url": "https://git.kernel.org/stable/c/45962da5821d0a691f638ccb13842889156d8969",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dc14753664240cedf669623b27ae9922b0618b25",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f00def884a831dc49eb659dac2dd09dbfd21e67f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: return early from a zero-length flush\n\nSYNC_BO does not constrain its size, so a request for zero bytes reaches\ndrm_clflush_virt_range(), which ends with an unconditional\nclflushopt(end - 1). For an empty range that is the byte before the\nmapping, and abo->mem.kva comes from vmap(), so the access lands in the\nguard page below the vmalloc area and faults:\n\n BUG: unable to handle page fault for address: ffffd16fbbc70fff\n #PF: supervisor read access in kernel mode\n Oops: Oops: 0000 [#1] SMP NOPTI\n CPU: 7 UID: 1000 Comm: sync_bo_probe\n RIP: 0010:drm_clflush_virt_range+0x3c/0x70\n Call Trace:\n amdxdna_drm_sync_bo_ioctl+0x124/0x430 [amdxdna]\n drm_ioctl+0x301/0x4c0\n __x64_sys_ioctl+0x115/0x2f0\n do_syscall_64+0xa6/0x3d0\n\nAny process that can open the render node can do this. Reproduced 3 of 3\ntimes on a Strix Point NPU (1022:17f0), by calling SYNC_BO with size 0 on\nan AMDXDNA_BO_SHARE object. The import arm takes the same request but\nflushes the whole scatterlist, so it survives it.\n\nNothing needs flushing for an empty range, so answer before choosing a\npath."
}
],
"lastModified": "2026-09-16T11:17:08.667",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}