{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74721", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.929Z", "datePublished": "2026-08-22T15:33:13.960Z", "dateUpdated": "2026-08-22T15:33:13.960Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:33:13.960Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()\n\nTwo error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma)\nbefore returning an error code to the caller. This is incorrect:\namdxdna_gem_obj_mmap() registers an HMM interval notifier before calling\namdxdna_insert_pages(), and on a hard error it jumps to hmm_unreg to undo\nthat registration. Calling vm_ops->close() manually \u2014 which drops the\nshmem pages_pin_count and the GEM object reference that backs the VMA \u2014\nbefore the mmap syscall has even returned causes those resources to be\nreleased while the VMA is still alive. The kernel VMA teardown will call\nvm_ops->close() a second time when the process later unmaps the range,\nproducing a reference count underflow.\n\nReplace both hard-error returns with a deferred-fault approach that keeps\nthe VMA alive and retries page insertion through the HMM range-fault path."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/accel/amdxdna/amdxdna_gem.c"], "versions": [{"version": "e486147c912f653ef4b60a6c7dbd4168a4c56a9f", "lessThan": "1501e4d07c6fee0d50531a0d1cb2be01a63e6e75", "status": "affected", "versionType": "git"}, {"version": "e486147c912f653ef4b60a6c7dbd4168a4c56a9f", "lessThan": "8d51e0fd3e698919d2adeff71936377f0c0d4aa0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/accel/amdxdna/amdxdna_gem.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1501e4d07c6fee0d50531a0d1cb2be01a63e6e75"}, {"url": "https://git.kernel.org/stable/c/8d51e0fd3e698919d2adeff71936377f0c0d4aa0"}], "title": "accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/accel/amdxdna/amdxdna_gem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1501e4d07c6fee0d50531a0d1cb2be01a63e6e75", "status": "affected", "version": "e486147c912f653ef4b60a6c7dbd4168a4c56a9f", "versionType": "git"}, {"lessThan": "8d51e0fd3e698919d2adeff71936377f0c0d4aa0", "status": "affected", "version": "e486147c912f653ef4b60a6c7dbd4168a4c56a9f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/accel/amdxdna/amdxdna_gem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()\n\nTwo error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma)\nbefore returning an error code to the caller. This is incorrect:\namdxdna_gem_obj_mmap() registers an HMM interval notifier before calling\namdxdna_insert_pages(), and on a hard error it jumps to hmm_unreg to undo\nthat registration. Calling vm_ops->close() manually \u2014 which drops the\nshmem pages_pin_count and the GEM object reference that backs the VMA \u2014\nbefore the mmap syscall has even returned causes those resources to be\nreleased while the VMA is still alive. The kernel VMA teardown will call\nvm_ops->close() a second time when the process later unmaps the range,\nproducing a reference count underflow.\n\nReplace both hard-error returns with a deferred-fault approach that keeps\nthe VMA alive and retries page insertion through the HMM range-fault path."}], "id": "CVE-2026-74721", "lastModified": "2026-08-22T16:16:47.080", "metrics": {}, "published": "2026-08-22T16:16:47.080", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1501e4d07c6fee0d50531a0d1cb2be01a63e6e75"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8d51e0fd3e698919d2adeff71936377f0c0d4aa0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}