CVE-2026-74721

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the amdxdna insert pages() function where two error paths incorrectly call vma->vm ops->close(vma) before returning an error code. This occurs because amdxdna gem obj mmap() registers an HMM (Heterogeneous Memory Management) interval notifier before calling amdxdna insert pages(). Manually calling vm ops->close() drops the shmem pages pin count and the GEM (Graphics Execution Manager) object reference while the VMA (Virtual Memory Area) is still active. Consequently, when the process later unmaps the range, the kernel VMA teardown calls vm ops->close() a second time, leading to a reference count underflow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.