Linux kernel AMD XDNA driver: unprivileged mmap plus MADV_DONTNEED trips a BUG_ON

UnscoredCVE-2026-74716NVIDIA / GPU stackcurated

Impact

amdxdna_insert_pages() sets VM_MIXEDMAP and clears VM_PFNMAP, which lets an unprivileged process that mmaps a non-imported GEM object clear the PTEs with madvise(MADV_DONTNEED). The next access faults into drm_gem_shmem_fault(), and vmf_insert_pfn_prot() hits BUG_ON((vma->vm_flags & VM_MIXEDMAP) && pfn_valid(pfn)) because the backing page is ordinary system memory - the record describes this as locally exploitable and predictable. That is an unprivileged local denial of service that panics the whole node, so on a shared machine one tenant holding the accelerator device node can take down every other workload on it. Exposure applies only to hosts with AMD XDNA NPU hardware and the amdxdna driver loaded.

Who can reach it

Any local user or container holding an open handle to the amdxdna accel device node. No elevated privileges are required beyond access to that device.

What to do

Update to a stable kernel with the fix and reboot the node. As an interim measure, restrict which containers get the amdxdna accel device node - a device cgroup rule removes the path entirely for workloads that do not need the NPU, and nodes without the driver loaded are not affected at all.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-74716 https://git.kernel.org/stable/c/13339132d89d00b513dff0730bff3a313b9b13b5 https://git.kernel.org/stable/c/4a19f7ab5972ef608b31ae921419bc3e04b3f8ad

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.