Bug 2525438 (CVE-2026-80608)

Summary:	CVE-2026-80608 kernel: accel/amdxdna: Fix iommu domain lifetime race during device removal
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel. This vulnerability, located in the `accel/amdxdna` component, is a use-after-free issue. It occurs due to a race condition during device removal when `force_iova` mode is enabled, where a freed memory region can still be accessed. A local attacker could potentially exploit this to cause memory corruption, leading to system instability or a denial of service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-28 07:45:00 UTC

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Fix iommu domain lifetime race during device removal

When force_iova mode is enabled, amdxdna_remove() frees xdna->domain. If
amdxdna_gem_obj_free() is called after device removal, it may attempt to
access xdna->domain, resulting in a use-after-free.

Fix the race by adding freeing xdna->domain as a managed release action,
so its lifetime is managed by DRM and remains valid until all managed
resources are released.

Comment 1 gkamathe 2026-09-01 10:00:53 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082833-CVE-2026-80608-1115@gregkh/T