CVE-2026-89978

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: return early from a zero-length flush

SYNC_BO does not constrain its size, so a request for zero bytes reaches

drm_clflush_virt_range(), which ends with an unconditional

clflushopt(end - 1). For an empty range that is the byte before the

mapping, and abo->mem.kva comes from vmap(), so the access lands in the

guard page below the vmalloc area and faults:

BUG: unable to handle page fault for address: ffffd16fbbc70fff

#PF: supervisor read access in kernel mode

Oops: Oops: 0000 [#1] SMP NOPTI

CPU: 7 UID: 1000 Comm: sync_bo_probe

RIP: 0010:drm_clflush_virt_range+0x3c/0x70

Call Trace:

amdxdna_drm_sync_bo_ioctl+0x124/0x430 [amdxdna]

drm_ioctl+0x301/0x4c0

__x64_sys_ioctl+0x115/0x2f0

do_syscall_64+0xa6/0x3d0

Any process that can open the render node can do this. Reproduced 3 of 3

times on a Strix Point NPU (1022:17f0), by calling SYNC_BO with size 0 on

an AMDXDNA_BO_SHARE object. The i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References