Linux Kernel up to 7.1.8 amdxdna amdxdna_insert_pages assertion

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.1.8. It has been rated as problematic. This impacts the function amdxdna_insert_pages of the component amdxdna. This manipulation causes assertion. This vulnerability appears as CVE-2026-74716. The attack requires local access. There is no available exploit.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.8. It has been declared as problematic. Affected by this vulnerability is the function amdxdna_insert_pages of the component amdxdna. The manipulation with an unknown input leads to a assertion vulnerability. The CWE definition for the vulnerability is CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. As an impact it is known to affect integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages() In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears VM_PFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls madvise(MADV_DONTNEED), the PTEs will be successfully cleared because VM_MIXEDMAP allows this (unlike VM_PFNMAP). When userspace subsequently accesses the memory, drm_gem_shmem_fault() handles the page fault and attempts to map the backing shmem page via vmf_insert_pfn() which calls vmf_insert_pfn_prot(). Because the backing shmem page is normal system memory (pfn_valid(pfn) is true) and the VMA now has VM_MIXEDMAP set, won't this predictably trigger the explicit assertion BUG_ON((vma->vm_flags & VM_MIXEDMAP) && pfn_valid(pfn)) Fix by removing the vm_flags_mod() call and replacing the vm_insert_pages() pre-population with the handle_mm_fault() loop that was already used for the import (dma-buf) path.

The advisory is shared at git.kernel.org. This vulnerability is known as CVE-2026-74716 since 08/15/2026. The exploitation appears to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/22/2026).

Upgrading to version 7.1.9 eliminates this vulnerability. Applying the patch 13339132d89d00b513dff0730bff3a313b9b13b5/4a19f7ab5972ef608b31ae921419bc3e04b3f8ad is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-64403). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.1.8

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion