CVE-2026-74721 accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
A use-after-free vulnerability in the Linux kernel's AMD XDNA driver allows local attackers to cause reference count underflows, potentially leading to privilege escalation or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74721?
CVE-2026-74721 is a high-severity use after free vulnerability in Linux, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
Two error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma) before returning an error code to the caller. This is incorrect: amdxdna_gem_obj_mmap() registers an HMM interval notifier before calling amdxdna_insert_pages(), and on a hard error it jumps to hmm_unreg to undo that registration. Calling vm_ops->close() manually — which drops the shmem pages_pin_count and the GEM object reference that backs the VMA — before the mmap syscall has even returned causes those resources to be released while the VMA is still alive. The kernel VMA teardown will call vm_ops->close() a second time when the process later unmaps the range, producing a reference count underflow.
Replace both hard-error returns with a deferred-fault approach that keeps the VMA alive and retries page insertion through the HMM range-fault path.
Which versions are affected by CVE-2026-74721?
How do I fix CVE-2026-74721?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-74721 being exploited?
There is no known exploitation of CVE-2026-74721 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74721, DEBIAN-CVE-2026-74721, GHSA-grmx-x9wr-gmvh, UBUNTU-CVE-2026-74721.