CVE-2026-98146
Linux: accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain
Linux LinuxOperating systemsCVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.09%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in93fa3e925b15b0ded0a549fe7f12bfbb1c4e171aAlso 52f3e086760a9a3e02a46a10b57caffd73b1c204CVE List
What fixes it
- 93fa3e925b15b0ded0a549fe7f12bfbb1c4e171aLinuxCVE List
- 52f3e086760a9a3e02a46a10b57caffd73b1c204LinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain
struct amdxdna_cmd_chain contains a flexible array annotated with __counted_by(command_count). Since the structure is stored in shared AMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently. If command_count is changed to zero, the bounds check generated from __counted_by may fail and trigger a kernel panic.
Remove __counted_by to avoid relying on the userspace-controlled command_count for the flexible array bounds check.
Text from CVE List
Affected versions 8
- Linuxaffected: aac243092b707bb3018e951d470cc1a9bcbaba6c before 93fa3e925b15b0ded0a549fe7f12bfbb1c4e171aCVE List
- Linuxaffected: aac243092b707bb3018e951d470cc1a9bcbaba6c before 52f3e086760a9a3e02a46a10b57caffd73b1c204CVE List
- Linuxaffected: aac243092b707bb3018e951d470cc1a9bcbaba6c before b3709d354545e70388177500761f92d906c4dfd6CVE List
- Linuxaffected: 6.14CVE List
- Linuxunaffected: all versions before 6.14CVE List
- Linuxunaffected: 6.18.53 through 6.18.*CVE List
- Linuxunaffected: 7.2.7 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List