CVE-2026-23328: accel/amdxdna: Fix NULL pointer dereference of mgmt_chann
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Fix NULL pointer dereference of mgmtchann
mgmtchann may be set to NULL if the firmware returns an unexpected error in aie2sendmgmtmsgwait(). This can later lead to a NULL pointer dereference in aie2hwstop().
Fix this by introducing a dedicated helper to destroy mgmtchann and by adding proper NULL checks before accessing it.
Affected Software
Remediation
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
An attacker or local user needs local access with low privileges and must cause the AMD XDNA driver to encounter an unexpected firmware error in aie2_send_mgmt_msg_wait(). That error can leave mgmt_chann set to NULL, which may later be dereferenced during aie2_hw_stop().
What is the likely impact?
The reported impact is availability loss: the NULL pointer dereference can crash or otherwise disrupt the affected kernel component. The CVSS vector indicates no confidentiality or integrity impact.
What should be done if patching cannot happen immediately?
No workaround is provided in the available information. Prioritize applying the available kernel patch, particularly on systems where local low-privileged users can interact with the affected AMD XDNA functionality.