CVE-2026-72092accel/amdxdna: reject command submission on devices without a submit op
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdna_cmd_submit() calls xdna->dev_info->ops->cmd_submit() unconditionally, but only aie2_dev_ops defines that callback. aie4_vf_ops (the AIE4 SR-IOV virtual function) does not, so a user AMDXDNA_EXEC_CMD ioctl on an AIE4 device reaches a NULL function-pointer call and oopses the kernel. AIE4 submits work through a mapped user queue and doorbell, not this ioctl path. Reject the submission early with -EOPNOTSUPP when the device provides no cmd_submit op, so the shared EXEC ioctl is a clean no-op on such devices. Found by 0sec automated security-research tooling (https://0sec.ai).
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from aac243092b707bb3018e951d470cc1a9bcbaba6c before af7a4c2caa7a191d6e7ed33903b69f9901874cd0; from aac243092b707bb3018e951d470cc1a9bcbaba6c before f7d08603c87bae19ca3e424da5ab6d0aee81886e; from aac243092b707bb3018e951d470cc1a9bcbaba6c before 38953513d7313992676d4136cd425cdb70c6278e | CNA record |
References
- https://git.kernel.org/stable/c/af7a4c2caa7a191d6e7ed33903b69f9901874cd0
- https://git.kernel.org/stable/c/f7d08603c87bae19ca3e424da5ab6d0aee81886e
- https://git.kernel.org/stable/c/38953513d7313992676d4136cd425cdb70c6278e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.