UBUNTU-CVE-2026-89978: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: return early from a zero-length flush SYNCBO does not constrain its size, so a request for zero bytes reaches drmclflushvirtrange(), which ends with an unconditional clflushopt(end - 1). For an empty range that is the byte before the mapping, and abo->mem.kva comes from vmap(), so the access lands in the guard page below the vmalloc area and faults: BUG: unable to handle page fault for address: ffffd16fbbc70fff #PF: supervisor read access in kernel mode Oops: Oops: 0000 [#1] SMP NOPTI CPU: 7 UID: 1000 Comm: syncboprobe RIP: 0010:drmclflushvirtrange+0x3c/0x70 Call Trace: amdxdnadrmsyncboioctl+0x124/0x430 [amdxdna] drmioctl+0x301/0x4c0 x64sysioctl+0x115/0x2f0 dosyscall64+0xa6/0x3d0 Any process that can open the render node can do this. Reproduced 3 of 3 times on a Strix Point NPU (1022:17f0), by calling SYNCBO with size 0 on an AMDXDNABOSHARE object. The import arm takes the same request but flushes the whole scatterlist, so it survives it. Nothing needs flushing for an empty range, so answer before choosing a path.