CVE-2026-74716: accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Fix locally exploitable BUGON in amdxdnainsertpages()
In amdxdnainsertpages(), vmflagsmod() sets VMMIXEDMAP and clears VMPFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls madvise(MADVDONTNEED), the PTEs will be successfully cleared because VMMIXEDMAP allows this (unlike VMPFNMAP).
When userspace subsequently accesses the memory, drmgemshmemfault() handles the page fault and attempts to map the backing shmem page via vmfinsertpfn() which calls vmfinsertpfnprot(). Because the backing shmem page is normal system memory (pfnvalid(pfn) is true) and the VMA now has VMMIXEDMAP set, won't this predictably trigger the explicit assertion BUGON((vma->vmflags & VMMIXEDMAP) && pfnvalid(pfn))
Fix by removing the vmflagsmod() call and replacing the vminsertpages() pre-population with the handlemmfault() loop that was already used for the import (dma-buf) path.
Affected Software
Event History
Frequently Asked Questions
Who can trigger this issue?
An unprivileged local userspace process can trigger it by mapping a non-imported GEM object, using madvise(MADV_DONTNEED), and then accessing the memory again.
What is the likely impact of successful exploitation?
The described fault path reaches an explicit BUG_ON assertion in the kernel. This indicates a local denial-of-service condition through a kernel crash or BUG.
Does the issue require an imported DMA-BUF object?
No. The vulnerable path specifically involves a non-imported GEM object; the import (dma-buf) path already used the handle_mm_fault() approach adopted by the fix.
How can administrators determine whether systems are affected?
Affected systems contain the vulnerable amdxdna_insert_pages() behavior that sets VM_MIXEDMAP with vm_flags_mod() and pre-populates pages using vm_insert_pages(). The referenced stable kernel commits contain the correction that removes this flag modification and uses handle_mm_fault() instead.