Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98146

accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain struct amdxdna_cmd_chain contains a flexible array annotated with __counted_by(command_count). Since the structure is stored in shared AMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently. If command_count is changed to zero, the bounds check generated from __counted_by may fail and trigger a kernel panic. Remove __counted_by to avoid relying on the userspace-controlled command_count for the flexible array bounds check.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • aac243092b707bb3018e951d470cc1a9bcbaba6c to < 93fa3e925b15b0ded0a549fe7f12bfbb1c4e171aaffected
  • aac243092b707bb3018e951d470cc1a9bcbaba6c to < 52f3e086760a9a3e02a46a10b57caffd73b1c204affected
  • aac243092b707bb3018e951d470cc1a9bcbaba6c to < b3709d354545e70388177500761f92d906c4dfd6affected

Linux Linux

Default version status: affected

  • 6.14affected
  • 0 to < 6.14unaffected
  • 6.18.53 to ≤ 6.18.*unaffected
  • 7.2.7 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References