CVE-2026-98145
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose command_count is zero passes the payload length check, because struct_size(payload, data, 0) is just the header. The fill loop then does not run, so offset stays zero and the request is submitted with a zero-length buffer. On firmware without AIE2_NPU_COMMAND that ends at the opcode check, since op is still ERT_INVALID_CMD and aie2_get_chain_msg_op() answers MSG_OP_MAX_OPCODE. aie2_get_npu_chain_msg_op() answers MSG_OP_CHAIN_EXEC_NPU whatever it is given, so there the submission continues to drm_clflush_virt_range(cmd_buf, 0), which reads the byte before the buffer and faults on the vmap guard page. EXEC_CMD is reachable by any process that can open the render node. Reject the request instead.
Affected versions
Linux kernel versions
7.1
and later are affected. Fixed in
7.2.7,
7.3-rc2
and their respective stable series.
References
2 totalFrequently asked questions
-
What is CVE-2026-98145?
CVE-2026-98145 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 7.1 onward and has been patched in 7.2.7 and 7.3-rc2. CVE-2026-98145 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98145?
Yes. CVE-2026-98145 has been patched. Fixed versions include 7.2.7 and 7.3-rc2. If you are running Linux kernel 7.1 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98145 actively exploited?
No. CVE-2026-98145 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.