Linux Kernel up to 7.1.4 amdxdna amdxdna_drm_sync_bo_ioctl handle/driver_priv improper synchronization

Summaryinfo

A vulnerability classified as very critical was found in Linux Kernel up to 7.1.4. Impacted is the function amdxdna_drm_sync_bo_ioctl of the component amdxdna. The manipulation of the argument handle/driver_priv results in improper synchronization. This vulnerability is identified as CVE-2026-72090. The attack is only possible with local access. There is not any exploit available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.4. It has been classified as very critical. Affected is the function amdxdna_drm_sync_bo_ioctl of the component amdxdna. The manipulation of the argument handle/driver_priv with an unknown input leads to a improper synchronization vulnerability. CWE is classifying the issue as CWE-662. The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdna_drm_sync_bo_ioctl() looks up args->handle in the ioctl caller's drm_file. For SYNC_DIRECT_FROM_DEVICE, it then calls amdxdna_hwctx_sync_debug_bo(), but passes abo->client. amdxdna_hwctx_sync_debug_bo() uses the passed client both as the handle namespace for debug_bo_hdl and as the owner of the hardware context xarray. Those must match the file that supplied args->handle. The BO's stored client pointer is object state, not the ioctl context. Pass filp->driver_priv instead, matching the original handle lookup.

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2026-72090 since 08/09/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/15/2026).

Upgrading to version 7.1.5 or 7.2-rc1 eliminates this vulnerability. Applying the patch 216e43d93dd49ec253052741aa476e51a8c54cd8/7caf2a2351d4053075670ff3e26a6815da0a9e1e is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion