CVE-2026-89978: accel/amdxdna: return early from a zero-length flush
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: return early from a zero-length flush
SYNCBO does not constrain its size, so a request for zero bytes reaches drmclflushvirtrange(), which ends with an unconditional clflushopt(end - 1). For an empty range that is the byte before the mapping, and abo->mem.kva comes from vmap(), so the access lands in the guard page below the vmalloc area and faults:
BUG: unable to handle page fault for address: ffffd16fbbc70fff #PF: supervisor read access in kernel mode Oops: Oops: 0000 [#1] SMP NOPTI CPU: 7 UID: 1000 Comm: syncboprobe RIP: 0010:drmclflushvirtrange+0x3c/0x70 Call Trace: amdxdnadrmsyncboioctl+0x124/0x430 [amdxdna] drmioctl+0x301/0x4c0 x64sysioctl+0x115/0x2f0 dosyscall64+0xa6/0x3d0
Any process that can open the render node can do this. Reproduced 3 of 3 times on a Strix Point NPU (1022:17f0), by calling SYNCBO with size 0 on an AMDXDNABOSHARE object. The import arm takes the same request but flushes the whole scatterlist, so it survives it.
Nothing needs flushing for an empty range, so answer before choosing a path.
Event History
Frequently Asked Questions
Who can trigger the fault?
Any local process that can open the AMDXDNA render node can trigger it. The reproduced case used an AMDXDNA_BO_SHARE object.
What input is required to exploit the issue?
The process must issue SYNC_BO with a size of 0 against a mapping-backed buffer. This causes the flush path to access the byte immediately before the mapped range and fault in the vmalloc guard page.
What is the observed impact?
The zero-length request causes a supervisor-mode kernel page fault and an Oops in drm_clflush_virt_range(). The report reproduced the failure three out of three times on a Strix Point NPU with device ID 1022:17f0.
Are all zero-length SYNC_BO requests affected in the same way?
No. The import path accepts the same request but flushes the full scatterlist, so it does not fault in the reported scenario. The vulnerable behavior is associated with the path that reaches drm_clflush_virt_range() for an empty range.