CVE-2026-98145

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the accel/amdxdna component where the system fails to reject command chains that contain no commands. When the command count variable is zero, the payload length check is bypassed because the size is calculated as only the header. Consequently, the fill loop is skipped, the offset remains zero, and the request is submitted with a zero-length buffer. On specific firmware lacking AIE2 NPU COMMAND, the process continues through aie2 get npu chain msg op() and reaches drm clflush virt range(cmd buf, 0), which attempts to read the byte preceding the buffer, resulting in a fault on the vmap guard page. This condition is reachable by any process capable of opening the render node.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.