CVE-2026-72091

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the drm sched worker of the Linux kernel. The issue occurs when amdxdna drm submit execbuf() passes a user-supplied command BO handle to amdxdna cmd submit() while drv cmd is NULL. If the handle is AMDXDNA INVALID BO HANDLE (0), the system skips fetching job->cmd bo, leaving it NULL. Subsequently, aie2 sched job run() calls amdxdna cmd set state(job->cmd bo), leading to a chain of calls through amdxdna gem vmap(NULL) and to gobj(NULL)->dev, which triggers a kernel oops. A process with access to the accel node on a system with a probed AMD NPU can trigger this by using a single AMDXDNA EXEC CMD ioctl with cmd handles set to 0.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.