Riskcovery

CVE-2026-72092

accel/amdxdna: reject command submission on devices without a submit op

State
Published
Severity
Not scored
Published
Aug 15, 2026
Updated
Aug 17, 2026
Reserved
Aug 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: reject command submission on devices without a submit op

amdxdna_cmd_submit() calls xdna->dev_info->ops->cmd_submit() unconditionally, but only aie2_dev_ops defines that callback. aie4_vf_ops (the AIE4 SR-IOV virtual function) does not, so a user AMDXDNA_EXEC_CMD ioctl on an AIE4 device reaches a NULL function-pointer call and oopses the kernel. AIE4 submits work through a mapped user queue and doorbell, not this ioctl path.

Reject the submission early with -EOPNOTSUPP when the device provides no cmd_submit op, so the shared EXEC ioctl is a clean no-op on such devices.

Found by 0sec automated security-research tooling (https://0sec.ai).

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • aac243092b707bb3018e951d470cc1a9bcbaba6c to before af7a4c2caa7a191d6e7ed33903b69f9901874cd0Affected
  • aac243092b707bb3018e951d470cc1a9bcbaba6c to before f7d08603c87bae19ca3e424da5ab6d0aee81886eAffected
  • aac243092b707bb3018e951d470cc1a9bcbaba6c to before 38953513d7313992676d4136cd425cdb70c6278eAffected
LinuxLinux
  • 6.14Affected
  • before 6.14Not affected
  • 6.18.42 through 6.18.*Not affected
  • 7.1.5 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.