CVE-2026-98146: accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Remove countedby from struct amdxdnacmdchain
struct amdxdnacmdchain contains a flexible array annotated with countedby(commandcount). Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modify commandcount concurrently. If commandcount is changed to zero, the bounds check generated from countedby may fail and trigger a kernel panic.
Remove countedby to avoid relying on the userspace-controlled commandcount for the flexible array bounds check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Remove the __counted_by(command_count) annotation from the flexible array in struct amdxdna_cmd_chain so bounds checking does not rely on the userspace-controlled command_count.
Event History
Frequently Asked Questions
Who can trigger the kernel panic?
A userspace actor able to modify the shared AMDXDNA_BO_SHARE memory containing an amdxdna_cmd_chain can change command_count concurrently. Setting command_count to zero can cause the generated flexible-array bounds check to fail and panic the kernel.
What condition makes this issue possible?
The command_count field is userspace-controlled because the structure resides in shared AMDXDNA_BO_SHARE memory. The removed __counted_by(command_count) annotation caused kernel bounds checking to rely on that mutable field.
What is the remediation?
Apply a Linux kernel update containing the change that removes __counted_by from struct amdxdna_cmd_chain. The provided stable-kernel references identify commits carrying the fix.