Linux Kernel up to 7.1.4/7.2-rc2 accel-amdxdna amdxdna_hwctx_sync_debug_bo deadlock

Summaryinfo

A vulnerability described as problematic has been identified in Linux Kernel up to 7.1.4/7.2-rc2. This issue affects the function amdxdna_hwctx_sync_debug_bo of the component accel-amdxdna. Executing a manipulation can lead to deadlock. The identification of this vulnerability is CVE-2026-72332. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.4/7.2-rc2. It has been declared as problematic. This vulnerability affects the function amdxdna_hwctx_sync_debug_bo of the component accel-amdxdna. The manipulation with an unknown input leads to a deadlock vulnerability. The CWE definition for the vulnerability is CWE-833. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. As an impact it is known to affect availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo() amdxdna_hwctx_sync_debug_bo() invokes the hardware hwctx_sync_debug_bo() callback while holding xdna->dev_lock. The callback may call amdxdna_cmd_submit(), which in turn calls amdxdna_pm_resume_get(). If the device is suspended, amdxdna_pm_resume_get() may synchronously execute amdxdna_pm_resume(), which also acquires xdna->dev_lock, resulting in a deadlock. Avoid the deadlock by calling amdxdna_pm_resume_get() before holding xdna->dev_lock in both amdxdna_hwctx_sync_debug_bo() and amdxdna_drm_config_hwctx_ioctl()

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-72332 since 08/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are needed for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 7.1.5 or 7.2-rc3 eliminates this vulnerability. Applying the patch 2d8eeb0578ae3aadf112fd3e1997e58178f75979/e35c9cf5512814fb04f369f2eada64f0a7164609 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.2-rc1
• 7.2-rc2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion