UBUNTU-CVE-2026-74716: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUGON in amdxdnainsertpages() In amdxdnainsertpages(), vmflagsmod() sets VMMIXEDMAP and clears VMPFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls madvise(MADVDONTNEED), the PTEs will be successfully cleared because VMMIXEDMAP allows this (unlike VMPFNMAP). When userspace subsequently accesses the memory, drmgemshmemfault() handles the page fault and attempts to map the backing shmem page via vmfinsertpfn() which calls vmfinsertpfnprot(). Because the backing shmem page is normal system memory (pfnvalid(pfn) is true) and the VMA now has VMMIXEDMAP set, won't this predictably trigger the explicit assertion BUGON((vma->vmflags & VMMIXEDMAP) && pfnvalid(pfn)) Fix by removing the vmflagsmod() call and replacing the vminsertpages() pre-population with the handlemmfault() loop that was already used for the import (dma-buf) path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In amdxdna_insert_pages(), remove the vm_flags_mod() call and replace vm_insert_pages() pre-population with the handle_mm_fault() loop already used for the import (dma-buf) path.