CVE-2026-72328

Description

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdna_umap lifetime race amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove() before removing the object from abo->mem.umap_list. If aie2_populate_range() runs concurrently, it may obtain a reference to an amdxdna_umap that is being released, leading to a potential use-after-free. Use kref_get_unless_zero() in aie2_populate_range() when acquiring a reference. If the reference count has already dropped to zero, release is in progress and the entry is skipped.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://git.kernel.org/stable/c/267809e2c56fbea486f7250c8a4acddcc3c54dc5 ↗
• https://git.kernel.org/stable/c/91e8109ecffb925b6202d2737384df285b195bfb ↗
• https://git.kernel.org/stable/c/14f172eff9c19f8043a9858845f33cd034f3a41e ↗