CVE-2026-98436: Linux Kernel AMDXDNA Buffer Vulnerability

CVE-2026-98436 Overview

CVE-2026-98436 affects the Linux kernel's accel/amdxdna driver, which supports AMD XDNA (Xilinx Deep-learning Neural Network Accelerator) devices. The vulnerability stems from the driver allowing device buffers to be exported through the DMA-BUF subsystem. Device buffers are never intended to be exported outside the driver's control. Kernel maintainers resolved the issue by explicitly disabling export support for these buffers.

Critical Impact
Improper exposure of device buffers through DMA-BUF export could allow unintended cross-driver or userspace access to memory regions managed by the AMD XDNA accelerator driver.

Affected Products

Linux kernel builds that include the accel/amdxdna driver
Systems using AMD XDNA (Ryzen AI NPU) accelerators
Distributions shipping affected mainline kernel versions prior to the fix commits

Discovery Timeline

2026-10-18 - CVE-2026-98436 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98436

Vulnerability Analysis

The accel/amdxdna driver manages memory buffers for the AMD XDNA accelerator subsystem. These buffers are tied to device-specific memory regions and are not meant to be shared with other drivers or userspace consumers via the DMA-BUF export interface. The driver did not explicitly disable the export path, so buffer objects of this type could be exported like any other Graphics Execution Manager (GEM) object.

Exporting device-only buffers creates a mismatch between the driver's internal memory assumptions and how external consumers map or reference that memory. The fix removes export support by setting the appropriate GEM object export callback to prevent the operation from succeeding.

Root Cause

The root cause is a missing restriction in the GEM object export path for the amdxdna device buffer type. By default, GEM objects inherit export capability through DMA-BUF, so any buffer created by the driver could be converted into a file descriptor and shared. The patch disables this behavior explicitly for device buffer objects.

Attack Vector

Exploitation requires local access to the device node exposed by the amdxdna driver, typically /dev/accel/accel*. A local process with permission to open the accelerator device could allocate a device buffer and request a DMA-BUF export. The resulting file descriptor could then be passed to other subsystems or processes, exposing memory that the driver assumed would remain internal. No public exploit is available and the vulnerability has not been observed in active exploitation.

// No verified exploit code is available for this issue.
// Refer to the upstream kernel commits for the fix:
//   git.kernel.org/stable/c/33b00fa8023e8ade3409aa9c833b8ce65b8c29eb
//   git.kernel.org/stable/c/9480dd7ec3fcadd4217503e4bb32c16e19e4b21f

Detection Methods for CVE-2026-98436

Indicators of Compromise

No known indicators of compromise are published for this vulnerability.
Unexpected DMA-BUF file descriptors referencing amdxdna buffers in /proc/<pid>/fd/ on systems with AMD XDNA hardware.
Unprivileged processes opening /dev/accel/* nodes without a legitimate workload reason.

Detection Strategies

Inventory running kernels against the fixed versions referenced in the upstream stable tree commits.
Audit which users and processes have access to the /dev/accel/* device nodes on AMD Ryzen AI systems.
Monitor kernel package versions through configuration management and alert on hosts that remain on vulnerable builds.

Monitoring Recommendations

Enable kernel audit rules for open and ioctl syscalls targeting /dev/accel/* device nodes.
Forward kernel logs and audit telemetry to a centralized analytics platform for retention and correlation.
Track vendor advisories from Linux distributions for backported fixes referencing the accel/amdxdna subsystem.

How to Mitigate CVE-2026-98436

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fixes 33b00fa8023e and 9480dd7ec3fc.
Restrict access to /dev/accel/* device nodes to trusted users and service accounts only.
Review workloads that interact with AMD XDNA accelerators and confirm they do not depend on exporting device buffers.

Patch Information

The fix is applied in two upstream commits in the Linux stable tree: kernel commit 33b00fa8023e and kernel commit 9480dd7ec3fc. Both commits disable DMA-BUF export support for amdxdna device buffers by removing the export callback from the GEM object function table. Apply the kernel update provided by your distribution once it incorporates these commits.

Workarounds

Unload or blacklist the amdxdna kernel module on systems that do not require AMD XDNA accelerator functionality.
Tighten file permissions on /dev/accel/* device nodes using udev rules to limit access to a dedicated group.
Use Linux Security Modules such as SELinux or AppArmor to restrict which processes may open the accelerator device.

bash

# Example udev rule to restrict access to the accel device node
# File: /etc/udev/rules.d/90-accel-restrict.rules
KERNEL=="accel[0-9]*", SUBSYSTEM=="accel", MODE="0660", GROUP="accel-users"

# Blacklist the module if the accelerator is not in use
# File: /etc/modprobe.d/blacklist-amdxdna.conf
blacklist amdxdna