CVE-2026-80608: accel/amdxdna: Fix iommu domain lifetime race during device removal
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Fix iommu domain lifetime race during device removal
When forceiova mode is enabled, amdxdnaremove() frees xdna->domain. If amdxdnagemobjfree() is called after device removal, it may attempt to access xdna->domain, resulting in a use-after-free.
Fix the race by adding freeing xdna->domain as a managed release action, so its lifetime is managed by DRM and remains valid until all managed resources are released.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this use-after-free condition?
Systems using the Linux kernel amdxdna accelerator driver with force_iova mode enabled are exposed. The race occurs during device removal when GEM object cleanup runs after the IOMMU domain has been freed.
What condition is required to trigger the issue?
The device must be removed while amdxdna GEM objects can still be freed afterward. In the affected path, amdxdna_gem_obj_free() accesses xdna->domain after amdxdna_remove() has freed it.
Is force_iova mode relevant to exploitation or exposure?
Yes. The described premature freeing of xdna->domain occurs when force_iova mode is enabled; the provided information does not indicate that the same path affects configurations without that mode.
How does the fix prevent the race?
The fix registers freeing xdna->domain as a managed release action. This keeps the IOMMU domain valid until DRM has released all managed resources, including any later GEM object cleanup.