Description

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix iommu domain lifetime race during device removal When force_iova mode is enabled, amdxdna_remove() frees xdna->domain. If amdxdna_gem_obj_free() is called after device removal, it may attempt to access xdna->domain, resulting in a use-after-free. Fix the race by adding freeing xdna->domain as a managed release action, so its lifetime is managed by DRM and remains valid until all managed resources are released.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T08:16:44.777Z",
  "pubdate": "2026-08-28T08:16:44.777Z",
  "executiveSummary": "This vulnerability involves a use-after-free condition within the amdxdna Linux kernel driver, specifically occurring during the device removal process when force_iova mode is active.\nThe flaw stems from a race condition where the IOMMU domain is prematurely deallocated while subsequent object cleanup routines, such as amdxdna_gem_obj_free(), still maintain references to it.\nSuccessful exploitation could lead to kernel memory corruption, arbitrary code execution, or system instability/crashes.\nThe vulnerability resides in the interaction between the device's removal path and the DRM-managed object lifecycle.\nThe risk is significant for systems utilizing the amdxdna accelerator, as it allows for potential privilege escalation if an attacker can trigger the race condition during a period of device teardown.\nNo specific network exposure is required, as the attack is local in nature, necessitating a user with sufficient privileges to interact with the device driver.",
  "technicalDetails": "The root cause of this vulnerability is an improper synchronization mechanism between the amdxdna_remove() device teardown sequence and the object management lifecycle handled by the Direct Rendering Manager (DRM) subsystem.\nIn the amdxdna driver, when force_iova mode is enabled, the driver allocates an IOMMU domain (xdna->domain) to manage IOVA mappings. The current implementation explicitly frees this domain within the amdxdna_remove() function. However, the driver's GEM (Graphics Execution Manager) objects continue to exist after the initial removal call is initiated.\nIf an object cleanup operation, such as amdxdna_gem_obj_free(), is triggered—either by a process holding an open file descriptor to the device or through asynchronous cleanup tasks—the function attempts to reference xdna->domain to perform memory management or IOMMU cleanup. Because the domain has already been freed by the removal logic, the pointer becomes dangling, resulting in a use-after-free (UAF) condition.\nThe attack flow follows these steps: 1) The attacker initiates the removal of the amdxdna device or triggers a condition that causes the driver to enter its teardown phase while force_iova mode is active. 2) The amdxdna_remove() function executes, deallocating the xdna->domain structure. 3) The attacker triggers an action that invokes amdxdna_gem_obj_free() (e.g., closing a memory-mapped buffer or destroying a GEM handle). 4) The kernel dereferences the now-stale pointer to xdna->domain, leading to a kernel panic or potentially allowing the attacker to manipulate the kernel heap if they can influence the contents of the memory previously occupied by the domain structure.\nThis vulnerability is classified as a local privilege escalation vector. Exploitation requires the ability to interact with the device driver via IOCTLs, meaning the attacker must have the necessary permissions to open the device node. The impact is critical, as it bypasses memory safety checks, enabling potential overwrite of kernel function pointers or control structures. By carefully timing the device removal against object destruction, an attacker can reliably cause the kernel to access freed memory.\nThe resolution involves transitioning the lifecycle management of xdna->domain from manual deallocation in the removal path to a managed release action within the DRM framework, ensuring the IOMMU domain remains valid until all dependent GEM objects have been safely released."
}