CVE-2026-80608: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80608 Overview

CVE-2026-80608 is a use-after-free vulnerability in the Linux kernel's accel/amdxdna driver. The flaw affects the AMD XDNA accelerator driver when force_iova mode is enabled. During device removal, amdxdna_remove() frees the xdna->domain structure. A subsequent call to amdxdna_gem_obj_free() can then dereference the freed IOMMU domain pointer. This creates a race condition between device teardown and Direct Rendering Manager (DRM) graphics execution manager (GEM) object cleanup. Local attackers with low privileges can trigger the race to corrupt kernel memory. The upstream fix converts the domain release into a DRM-managed action so the domain remains valid until all managed resources are released.

Critical Impact
A local attacker with low privileges can trigger a kernel use-after-free that may lead to privilege escalation, kernel memory corruption, or denial of service on systems using the AMD XDNA accelerator driver.

Affected Products

Linux kernel accel/amdxdna driver (AMD XDNA AI accelerator)
Kernel builds compiled with the amdxdna driver where force_iova mode is enabled
Downstream distributions shipping the vulnerable amdxdna driver prior to the fix

Discovery Timeline

2026-08-28 - CVE-2026-80608 published to the National Vulnerability Database (NVD)
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80608

Vulnerability Analysis

The vulnerability resides in the AMD XDNA accelerator driver (accel/amdxdna) within the Linux kernel. The driver manages IOMMU domains for direct memory access from the accelerator hardware to host memory. When operating in force_iova mode, the driver allocates an IOMMU domain stored at xdna->domain.

During device removal, amdxdna_remove() releases this domain synchronously. However, DRM GEM objects associated with the device may outlive the removal callback. When amdxdna_gem_obj_free() executes after amdxdna_remove(), it accesses the already-freed xdna->domain pointer. This yields a classic use-after-free condition in kernel space.

The scope-changed attack impact indicates the vulnerability crosses a security boundary. Successful exploitation can compromise kernel integrity, expose memory contents, or crash the system.

Root Cause

The root cause is improper lifetime management of the IOMMU domain resource. The xdna->domain allocation is not tied to the DRM device's managed resource lifecycle. Removal of the underlying device frees the domain even when GEM objects still hold references that will later dereference it. The upstream patch registers domain freeing as a drmm_add_action-style managed release action, ensuring the domain remains valid until all DRM-managed resources have been released.

Attack Vector

Exploitation requires local access with low privileges on a system running the vulnerable amdxdna driver in force_iova mode. An attacker with permissions to open the accelerator device node and allocate GEM objects can race device removal against object cleanup. Triggering the race requires the ability to induce or observe device removal events, which may involve unbinding the driver via sysfs or hot-removing the underlying PCI device.

No verified proof-of-concept code is publicly available. Refer to the upstream fix commits for technical details of the corrected lifetime management.

Detection Methods for CVE-2026-80608

Indicators of Compromise

Kernel oops or panic messages referencing amdxdna_gem_obj_free or IOMMU domain functions after driver unbind events
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in xdna->domain accesses on instrumented kernels
Unexpected DRM device teardown followed by GEM object cleanup errors in dmesg

Detection Strategies

Audit installed kernel packages against distribution advisories to identify hosts still running vulnerable amdxdna driver versions
Monitor kernel ring buffer for warnings originating from the accel/amdxdna subsystem during device probe, remove, and GEM cleanup paths
Correlate device unbind events in udev logs with subsequent process crashes or kernel faults on systems equipped with AMD XDNA hardware

Monitoring Recommendations

Enable kernel crash dump collection (kdump) on systems using AMD XDNA accelerators to capture forensic data if the race triggers a panic
Ingest dmesg and journald kernel facility logs into a centralized data lake for anomaly detection on driver subsystems
Track privileged operations that unbind or rebind PCI devices via sysfs, particularly targeting amdxdna device paths

How to Mitigate CVE-2026-80608

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the fix commits 65e7e2b8d71b and b4a0500fdf6e and reboot affected hosts
Inventory systems containing AMD XDNA accelerator hardware and prioritize patching those with the amdxdna driver loaded
Restrict local access to the accelerator device nodes to trusted users until patches are deployed

Patch Information

The fix is available in upstream Linux stable trees. See the Kernel Git Commit (65e7e2b8d71b) and the Kernel Git Commit (b4a0500fdf6e). The patch converts the xdna->domain release into a DRM-managed action so its lifetime is governed by the DRM subsystem and remains valid until all managed resources are released.

Workarounds

Unload the amdxdna kernel module on systems that do not require the AMD XDNA accelerator until a patched kernel is deployed
Disable force_iova mode in the amdxdna driver configuration where the operational requirements permit
Blacklist the amdxdna module via /etc/modprobe.d/ on hosts where the accelerator is not in use

bash

# Blacklist the amdxdna module until a patched kernel is deployed
echo "blacklist amdxdna" | sudo tee /etc/modprobe.d/blacklist-amdxdna.conf
sudo modprobe -r amdxdna
sudo update-initramfs -u