Linux kernel AMD XDNA driver: unprivileged mmap plus MADV_DONTNEED trips a BUG_ON

Impact

amdxdna_insert_pages() sets VM_MIXEDMAP and clears VM_PFNMAP, which lets an unprivileged process that mmaps a non-imported GEM object clear the PTEs with madvise(MADV_DONTNEED). The next access faults into drm_gem_shmem_fault(), and vmf_insert_pfn_prot() hits BUG_ON((vma->vm_flags & VM_MIXEDMAP) && pfn_valid(pfn)) because the backing page is ordinary system memory - the record describes this as locally exploitable and predictable. That is an unprivileged local denial of service that panics the whole node, so on a shared machine one tenant holding the accelerator device node can take down every other workload on it. Exposure applies only to hosts with AMD XDNA NPU hardware and the amdxdna driver loaded.

Who can reach it

Any local user or container holding an open handle to the amdxdna accel device node. No elevated privileges are required beyond access to that device.

What to do

Update to a stable kernel with the fix and reboot the node. As an interim measure, restrict which containers get the amdxdna accel device node - a device cgroup rule removes the path entirely for workloads that do not need the NPU, and nodes without the driver loaded are not affected at all.

References

Related entries

• Linux kernel AMD XDNA driver: error path closes a live VMA and underflows its referencesCVE-2026-74721 · Linux kernel accel/amdxdna (amdxdna_insert_pages error paths call vm_ops->close)Unscored
• GPU / accelerator firmware (VBIOS, GSP, NVSwitch): GPU-resident firmware sits below the host OS and is not coveredNCVD-0000-012-gpu-accelerator-firmware-vbios-g · GPU / accelerator firmware (VBIOS, GSP, NVSwitch)Unscored
• NVIDIA Multi-Instance GPU (MIG) partitioning: MIG gives each instance its own SM slice, L2 slice, memory slice andNCVD-2020-001-nvidia-multi-instance-gpu-mig-pa · NVIDIA Multi-Instance GPU (MIG) partitioningUnscored
• NVIDIA Multi-Instance GPU (MIG) partitioning: MIG gives each instance its own SM slice, L2 slice, memory slice andNCVD-2020-003-nvidia-multi-instance-gpu-mig-pa · NVIDIA Multi-Instance GPU (MIG) partitioningUnscored
• Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA): GPUs apply data-dependent losslessNCVD-2023-003-integrated-gpu-graphics-data-com · Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA)Unscored
• NVIDIA Confidential Computing (H100/H200/B100/B200/GB200) - CC-DevTools operating mode: NVIDIA GPU confidentialNCVD-2023-004-nvidia-confidential-computing-h1 · NVIDIA Confidential Computing (H100/H200/B100/B200/GB200) - CC-DevTools operating modeUnscored