« Volver al listado

CVE-2026-98145

Estado: En análisisSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: reject a command chain that carries no commands

A chain whose command_count is zero passes the payload length check, because struct_size(payload, data, 0) is just the header. The fill loop then does not run, so offset stays zero and the request is submitted with a zero-length buffer.

On firmware without AIE2_NPU_COMMAND that ends at the opcode check, since op is still ERT_INVALID_CMD and aie2_get_chain_msg_op() answers MSG_OP_MAX_OPCODE. aie2_get_npu_chain_msg_op() answers MSG_OP_CHAIN_EXEC_NPU whatever it is given, so there the submission continues to drm_clflush_virt_range(cmd_buf, 0), which reads the byte before the buffer and faults on the vmap guard page.

Leer descripción completaMostrar menos

EXEC_CMD is reachable by any process that can open the render node.

Reject the request instead.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98145",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "8ed8b02396172b137ca8c78c3cb999ddf4fb0bbf",
              "lessThan": "ed74e8d603df457bfcf16ed4f8f1660a1525759e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8ed8b02396172b137ca8c78c3cb999ddf4fb0bbf",
              "lessThan": "ef6d27af71e1dc43181ec797a6aaa77c27c36786",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/accel/amdxdna/aie2_message.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "7.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/accel/amdxdna/aie2_message.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:46.043",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/ed74e8d603df457bfcf16ed4f8f1660a1525759e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ef6d27af71e1dc43181ec797a6aaa77c27c36786",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: reject a command chain that carries no commands\n\nA chain whose command_count is zero passes the payload length check,\nbecause struct_size(payload, data, 0) is just the header. The fill loop\nthen does not run, so offset stays zero and the request is submitted with\na zero-length buffer.\n\nOn firmware without AIE2_NPU_COMMAND that ends at the opcode check, since\nop is still ERT_INVALID_CMD and aie2_get_chain_msg_op() answers\nMSG_OP_MAX_OPCODE. aie2_get_npu_chain_msg_op() answers\nMSG_OP_CHAIN_EXEC_NPU whatever it is given, so there the submission\ncontinues to drm_clflush_virt_range(cmd_buf, 0), which reads the byte\nbefore the buffer and faults on the vmap guard page. EXEC_CMD is\nreachable by any process that can open the render node.\n\nReject the request instead."
    }
  ],
  "lastModified": "2026-09-30T14:10:59.253",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}