CVE-2026-72328
Description
AI Translation Available
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Fix potential amdxdna_umap lifetime race
amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove()
before removing the object from abo->mem.umap_list. If
aie2_populate_range() runs concurrently, it may obtain a reference to an
amdxdna_umap that is being released, leading to a potential use-after-free.
Use kref_get_unless_zero() in aie2_populate_range() when acquiring a
reference. If the reference count has already dropped to zero, release
is in progress and the entry is skipped.
https://git.kernel.org/stable/c/14f172eff9c19f8043a9858845f33cd034f3a41e
https://git.kernel.org/stable/c/267809e2c56fbea486f7250c8a4acddcc3c54dc5
https://git.kernel.org/stable/c/91e8109ecffb925b6202d2737384df285b195bfb