CVE-2026-72332 Linux CVE debrief

Who should care

System administrators and users of Linux kernel-based systems using the accel/amdxdna component should be aware of this vulnerability and take steps to verify their system's exposure and apply patches or mitigations as needed.

Technical summary

The amdxdna_hwctx_sync_debug_bo() function in the Linux kernel's accel/amdxdna component holds the xdna->dev_lock while invoking a hardware callback. This may lead to a deadlock if the device is suspended and amdxdna_pm_resume_get() is called, which synchronously executes amdxdna_pm_resume(), also acquiring xdna->dev_lock. To avoid this, amdxdna_pm_resume_get() should be called before holding xdna->dev_lock in both amdxdna_hwctx_sync_debug_bo() and amdxdna_drm_config_hwctx_ioctl().

Defensive priority

This vulnerability may impact Linux kernel-based systems using the accel/amdxdna component. System administrators and users should be aware of the potential for denial-of-service attacks and take steps to verify their system's exposure.

Recommended defensive actions

• Verify system exposure and apply patches or mitigations as needed
• Monitor system logs for potential denial-of-service attacks
• Consider implementing compensating controls to mitigate potential impact
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis and verification are necessary to fully understand the impact and potential mitigations. Linux kernel-based systems using the accel/amdxdna component should verify their system's exposure. Evidence is limited; defenders should verify potential denial-of-service attacks and apply patches or mitigations as needed. The CVE record was published on 2026-08-15T06:22:06.310Z and has not been modified since then.

Official resources