Riskcovery

CVE-2026-98146

accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain

State
Published
Severity
Not scored
Published
Sep 25, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain

struct amdxdna_cmd_chain contains a flexible array annotated with __counted_by(command_count). Since the structure is stored in shared AMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently. If command_count is changed to zero, the bounds check generated from __counted_by may fail and trigger a kernel panic.

Remove __counted_by to avoid relying on the userspace-controlled command_count for the flexible array bounds check.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • aac243092b707bb3018e951d470cc1a9bcbaba6c to before 93fa3e925b15b0ded0a549fe7f12bfbb1c4e171aAffected
  • aac243092b707bb3018e951d470cc1a9bcbaba6c to before 52f3e086760a9a3e02a46a10b57caffd73b1c204Affected
  • aac243092b707bb3018e951d470cc1a9bcbaba6c to before b3709d354545e70388177500761f92d906c4dfd6Affected
LinuxLinux
  • 6.14Affected
  • before 6.14Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2.7 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.