SB20260816431 - Improper access control in Linux kernel accel amdxdna driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-72090)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access or manipulate debug buffer synchronization across client contexts.

The vulnerability exists due to improper access control in amdxdna_drm_sync_bo_ioctl() and amdxdna_hwctx_sync_debug_bo() when handling SYNC_DIRECT_FROM_DEVICE requests. A local user can invoke the ioctl with a crafted handle state to access or manipulate debug buffer synchronization across client contexts.

The issue occurs because the debug buffer handle namespace and hardware context ownership are resolved using the buffer object's stored client pointer instead of the calling file context.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/216e43d93dd49ec253052741aa476e51a8c54cd8
• https://git.kernel.org/stable/c/7caf2a2351d4053075670ff3e26a6815da0a9e1e