CVE-2026-45931: accel/amdxdna: Hold mm structure across iommu_sva_unbind_device()
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Hold mm structure across iommusvaunbinddevice()
Some tests trigger a crash in iommusvaunbinddevice() due to accessing iommumm after the associated mm structure has been freed.
Fix this by taking an explicit reference to the mm structure after successfully binding the device, and releasing it only after the device is unbound. This ensures the mm remains valid for the entire SVA bind/unbind lifetime.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (accel/amdxdna)to a version that resolves this vulnerability.Patch accel/amdxdna: Hold mm structure across iommu_sva_unbind_device() - Compensating control
In the mm lifecycle for the IOMMU SVA bind/unbind path, ensure the mm structure remains valid for the entire SVA bind/unbind lifetime by holding the associated mm across iommu_sva_unbind_device() and only releasing it after the device is unbound.
Event History
Frequently Asked Questions
What level of access does an attacker need?
The vulnerability is rated with local attack vector and low privileges required. No user interaction is required.
Under what condition does the crash occur?
The crash occurs during iommu_sva_unbind_device() when it accesses iommu_mm after the associated mm structure has already been freed. It affects the SVA device bind/unbind lifetime in the AMD XDNA accelerator driver.
What does the resolved fix change?
The fix takes an explicit reference to the mm structure after a successful device bind and releases that reference only after the device is unbound. This keeps the mm structure valid until unbinding completes.