CVE-2026-89978 accel/amdxdna: return early from a zero-length flush
A local attacker with access to the AMD XDNA render node can trigger a kernel page fault and crash the system by issuing a zero-length flush request.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89978?
CVE-2026-89978 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: return early from a zero-length flush
SYNC_BO does not constrain its size, so a request for zero bytes reaches drm_clflush_virt_range(), which ends with an unconditional clflushopt(end - 1). For an empty range that is the byte before the mapping, and abo->mem.kva comes from vmap(), so the access lands in the guard page below the vmalloc area and faults:
BUG: unable to handle page fault for address: ffffd16fbbc70fff #PF: supervisor read access in kernel mode Oops: Oops: 0000 [#1] SMP NOPTI CPU: 7 UID: 1000 Comm: sync_bo_probe RIP: 0010:drm_clflush_virt_range+0x3c/0x70 Call Trace: amdxdna_drm_sync_bo_ioctl+0x124/0x430 [amdxdna] drm_ioctl+0x301/0x4c0 __x64_sys_ioctl+0x115/0x2f0 do_syscall_64+0xa6/0x3d0
Any process that can open the render node can do this. Reproduced 3 of 3 times on a Strix Point NPU (1022:17f0), by calling SYNC_BO with size 0 on an AMDXDNA_BO_SHARE object. The import arm takes the same request but flushes the whole scatterlist, so it survives it.
Nothing needs flushing for an empty range, so answer before choosing a path.
Which versions are affected by CVE-2026-89978?
How do I fix CVE-2026-89978?
Apply the vendor's patch.
Is CVE-2026-89978 being exploited?
There is no known exploitation of CVE-2026-89978 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-89978, DEBIAN-CVE-2026-89978, GHSA-3x6j-vqfr-gqqm, UBUNTU-CVE-2026-89978.