CVE-2026-45908: Linux Kernel Information Disclosure Flaw

CVE-2026-45908 Overview

CVE-2026-45908 is a memory leak vulnerability in the Linux kernel's accel/amdxdna driver. The flaw resides in the amdxdna_ubuf_map() function, which allocates memory for scatter-gather (sg) structures and internal sg_table structures. When subsequent operations such as sg_alloc_table_from_pages() or dma_map_sgtable() fail, the function does not release the previously allocated memory. Repeated invocation of the failing code path causes progressive kernel memory exhaustion. The vulnerability has been resolved in upstream Linux kernel commits.

Critical Impact
Repeated triggering of the failing code path in amdxdna_ubuf_map() leaks kernel memory, leading to resource exhaustion and potential denial of service on systems using the AMD XDNA accelerator driver.

Affected Products

Linux kernel versions containing the accel/amdxdna driver prior to the patched commits
Systems with AMD XDNA neural processing accelerator hardware enabled
Distributions shipping the vulnerable amdxdna_ubuf_map() implementation

Discovery Timeline

2026-05-27 - CVE-2026-45908 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45908

Vulnerability Analysis

The vulnerability is a memory leak in the AMD XDNA accelerator driver located under drivers/accel/amdxdna. The amdxdna_ubuf_map() function prepares user buffers for DMA by allocating a scatter-gather descriptor and an internal sg_table structure. After these allocations succeed, the function calls sg_alloc_table_from_pages() to populate the table and dma_map_sgtable() to map it for device access.

When either of these follow-up calls returns an error, the function returns without freeing the sg structure or the sg_table it previously allocated. Each failed mapping attempt leaks kernel heap memory. An attacker with local access capable of triggering the failure paths repeatedly can exhaust kernel memory and destabilize the host.

Root Cause

The defect is a classic resource management error on an error path [CWE-401: Missing Release of Memory after Effective Lifetime]. The allocator-cleanup contract was not preserved when intermediate operations failed. The fix introduces proper cleanup that releases the allocated sg and sg_table structures before returning the error to the caller.

Attack Vector

Exploitation requires local access to a system running the vulnerable driver with AMD XDNA hardware present. A local user invoking the userspace buffer mapping interface with inputs that cause sg_alloc_table_from_pages() or dma_map_sgtable() to fail can trigger the leak. Sustained repetition drives memory pressure and degrades system stability. There is no indication of remote exploitation. No public exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

For implementation specifics, see the upstream fixes in Kernel Git Commit 5a68d2c, Kernel Git Commit 84dd57f, and Kernel Git Commit f9f4366.

Detection Methods for CVE-2026-45908

Indicators of Compromise

Steady growth of kernel slab memory consumption visible in /proc/slabinfo without a corresponding workload increase.
Repeated failures from sg_alloc_table_from_pages or dma_map_sgtable reported by the amdxdna driver in dmesg.
Slab or SUnreclaim values in /proc/meminfo trending upward over time on hosts with AMD XDNA hardware.

Detection Strategies

Audit installed kernel versions and compare against the patched stable commits to identify vulnerable hosts.
Track per-process invocation rates of the amdxdna ioctl interface to detect abnormal buffer mapping activity from local users.
Correlate kernel memory growth telemetry with amdxdna error log entries to identify active exploitation attempts.

Monitoring Recommendations

Centralize kernel logs and alert on recurring amdxdna_ubuf_map error returns from the same UID.
Establish baselines for slab memory usage on hosts equipped with AMD XDNA accelerators and alert on sustained deviations.
Monitor for out-of-memory killer activity targeting workloads unrelated to expected memory consumers.

How to Mitigate CVE-2026-45908

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 5a68d2c, 84dd57f, and f9f4366 to all affected stable branches.
Inventory systems with AMD XDNA hardware and prioritize them for kernel updates.
Restrict local access on multi-tenant systems until patched kernels are deployed.

Patch Information

The fix has been merged into the mainline and stable Linux kernel trees. Affected commits are Kernel Git Commit 5a68d2c, Kernel Git Commit 84dd57f, and Kernel Git Commit f9f4366. The patches add explicit cleanup of the sg and sg_table allocations in amdxdna_ubuf_map() when downstream operations fail. Pull the fix from your distribution vendor once it is included in their stable updates.

Workarounds

Unload the amdxdna kernel module on systems that do not require AMD XDNA accelerator functionality using modprobe -r amdxdna.
Blacklist the amdxdna driver in /etc/modprobe.d/ to prevent automatic load on boot where the hardware is unused.
Limit access to the amdxdna device nodes through restrictive udev rules until the kernel patch is applied.

bash

# Configuration example
# Disable the amdxdna driver until kernel is patched
echo 'blacklist amdxdna' | sudo tee /etc/modprobe.d/blacklist-amdxdna.conf
sudo modprobe -r amdxdna

# Restrict access to amdxdna device nodes
echo 'KERNEL=="accel*", SUBSYSTEM=="accel", MODE="0600", OWNER="root"' | \
  sudo tee /etc/udev/rules.d/90-amdxdna-restrict.rules
sudo udevadm control --reload-rules