SB2026102206 - Improper access control in Linux kernel accel amdxdna driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-98436)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to export device buffers that are not intended to be shared, potentially permitting unauthorized access to their contents.

The vulnerability exists due to insufficient access restrictions in the Linux kernel amdxdna driver's device buffer export handling when processing buffer export requests. A local user can request export of a device buffer to potentially expose its contents outside their intended access scope.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/33b00fa8023e8ade3409aa9c833b8ce65b8c29eb
• https://git.kernel.org/stable/c/9480dd7ec3fcadd4217503e4bb32c16e19e4b21f