CVE-2025-71303: accel/amdxdna: Fix race condition when checking rpm_on

Q: Who is exposed to this issue?

Systems using the Linux kernel amdxdna accelerator driver are exposed when autosuspend is in use and a userspace application can submit commands to the device.

Q: What conditions are required to trigger the race?

Autosuspend must be triggered, placing suspend or resume in progress, and a userspace application must submit a command during the narrow interval in which the driver rpm_on flag remains set. The incorrect flag check can then cause the resume operation to be skipped.

Q: What is the operational impact if the race occurs?

Commands can be submitted while the device has not actually resumed, leading to unexpected behavior. The CVSS vector identifies availability impact as high, with no confidentiality or integrity impact.

Q: What change resolves the issue?

The fix removes use of the rpm_on flag and introduces aie2_pm_set_dpm(), which explicitly resumes the device before calling set_dpm() when needed. Calls to set_dpm() made within suspend or resume execution paths remain direct.

Published May 27, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Fix race condition when checking rpmon

When autosuspend is triggered, driver rpmon flag is set to indicate that a suspend/resume is already in progress. However, when a userspace application submits a command during this narrow window, amdxdnapmresumeget() may incorrectly skip the resume operation because the rpmon flag is still set. This results in commands being submitted while the device has not actually resumed, causing unexpected behavior.

The setdpm() is called by suspend/resume, it relied on rpmon flag to avoid calling into rpm suspend/resume recursivly. So to fix this, remove the use of the rpmon flag entirely. Instead, introduce aie2pmsetdpm() which explicitly resumes the device before invoking setdpm(). With this change, setdpm() is called directly inside the suspend or resume execution path. Otherwise, aie2pmsetdpm() is called.

Affected Software

2 affected components

Linux Linux kernel

Linux Linux kernel>=6.19<6.19.4

Event History

May 27, 2026

CVE Published

via MITRE·12:14 PM

Data Sourced

via MITRE·12:14 PM

Description

Data Sourced

via NVD·02:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems using the Linux kernel amdxdna accelerator driver are exposed when autosuspend is in use and a userspace application can submit commands to the device.

What conditions are required to trigger the race?

Autosuspend must be triggered, placing suspend or resume in progress, and a userspace application must submit a command during the narrow interval in which the driver rpm_on flag remains set. The incorrect flag check can then cause the resume operation to be skipped.

What is the operational impact if the race occurs?

Commands can be submitted while the device has not actually resumed, leading to unexpected behavior. The CVSS vector identifies availability impact as high, with no confidentiality or integrity impact.

What change resolves the issue?

The fix removes use of the rpm_on flag and introduces aie2_pm_set_dpm(), which explicitly resumes the device before calling set_dpm() when needed. Calls to set_dpm() made within suspend or resume execution paths remain direct.

CVE-2025-71303: accel/amdxdna: Fix race condition when checking rpm_on

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What conditions are required to trigger the race?

What is the operational impact if the race occurs?

What change resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What conditions are required to trigger the race?

What is the operational impact if the race occurs?

What change resolves the issue?