Improper access control in Linux kernel - CVE-2026-98436
Published: October 22, 2026
Vulnerability identifier: #VU156734
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98436
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to export device buffers that are not intended to be shared, potentially permitting unauthorized access to their contents.
The vulnerability exists due to insufficient access restrictions in the Linux kernel amdxdna driver's device buffer export handling when processing buffer export requests. A local user can request export of a device buffer to potentially expose its contents outside their intended access scope.
Affected software
Linux kernel
How to mitigate CVE-2026-98436
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3