CVE-2026-72092: accel/amdxdna: reject command submission on devices without a submit op
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: reject command submission on devices without a submit op
amdxdnacmdsubmit() calls xdna->devinfo->ops->cmdsubmit() unconditionally, but only aie2devops defines that callback. aie4vfops (the AIE4 SR-IOV virtual function) does not, so a user AMDXDNAEXECCMD ioctl on an AIE4 device reaches a NULL function-pointer call and oopses the kernel. AIE4 submits work through a mapped user queue and doorbell, not this ioctl path.
Reject the submission early with -EOPNOTSUPP when the device provides no cmdsubmit op, so the shared EXEC ioctl is a clean no-op on such devices.
Found by 0sec automated security-research tooling (https://0sec.ai).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel so that amdxdna rejects the shared EXEC ioctl command submission early with -EOPNOTSUPP when the device does not provide accel/amdxdna submit op (i.e., devices like AIE4 SR-IOV aie4_vf_ops). This prevents amdxdna_cmd_submit() from calling xdna->dev_info->ops->cmd_submit() and doorbell paths that lead to a NULL function-pointer and kernel OOPS.
Linux kernel (amdxdna / AIE4 SR-IOV) Reject AIE4 command submissions when submit op is absent (amdxdna: reject command submission on devices without a submit op) = Return -EOPNOTSUPP early instead of reaching cmd_submit / EXEC ioctl NULL function-pointer
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72092?
The severity of CVE-2026-72092 is rated at risk level 53.
How do I fix CVE-2026-72092?
To fix CVE-2026-72092, ensure that command submissions are only allowed on devices that have the submit operation defined.
What systems are affected by CVE-2026-72092?
CVE-2026-72092 affects specific configurations of the Linux kernel that utilize the accel/amdxdna driver.
What component of the Linux kernel is involved in CVE-2026-72092?
CVE-2026-72092 involves the accel/amdxdna component of the Linux kernel.
What types of devices does CVE-2026-72092 impact?
CVE-2026-72092 impacts devices that do not have a defined submit operation in their command submission handling.