UBUNTU-CVE-2026-98146: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedby(commandcount). Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modify commandcount concurrently. If commandcount is changed to zero, the bounds check generated from countedby may fail and trigger a kernel panic. Remove countedby to avoid relying on the userspace-controlled commandcount for the flexible array bounds check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel accel/amdxdna implementation, remove the __counted_by annotation from the flexible array in struct amdxdna_cmd_chain so bounds checking does not rely on the userspace-controlled command_count.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the listed Ubuntu kernel packages are affected when the AMDXDNA driver is in use. Exploitation is local and requires low privileges; it is not described as remotely exploitable.
What does an attacker need to do to trigger the failure?
An attacker needs to modify the userspace-controlled command_count field in shared AMDXDNA_BO_SHARE memory while the kernel is using the associated command chain. Setting command_count to zero can cause the generated bounds check to fail and panic the kernel, resulting in denial of service.