PatchSiren cyber security CVE debrief
CVE-2026-98144 Linux CVE debrief
A Linux kernel vulnerability was resolved, involving a reference leak in the accel/amdxdna component. The issue arises when the mapping of a chained BO fails, causing a reference leak. This situation is not typically encountered in ordinary use, as the chain has already been submitted before this process runs. However, it can become reachable if the BO is resolved again by handle, and the handle is used by userspace to recycle: closing it after submission and importing a dma-buf whose exporter implements no vmap onto the same id leaves amdxdna_gem_get_obj() returning an object that cannot be mapped.
- Vendor
- Linux
- Product
- Unknown
- CVSS
- Unknown
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-09-25
- Original CVE updated
- 2026-09-25
- Advisory published
- 2026-09-25
- Advisory updated
- 2026-09-25
Who should care
Linux kernel developers, administrators, and users who utilize the accel/amdxdna component or similar functionality should assess their exposure to this vulnerability. Specific attention is required for configurations and use cases involving BO handle recycling and dma-buf import.
Why it matters
The CVE-2026-98144 vulnerability in the Linux kernel requires attention from developers, administrators, and users who utilize the accel/amdxdna component. While ordinary use does not expose this issue, specific scenarios involving BO handle recycling and dma-buf import may lead to a reference leak. Verification of kernel versions, assessment of specific use cases, and monitoring for patches are essential defensive actions.
- Verification of Linux kernel versions and configurations for exposure to the accel/amdxdna component is necessary.
- Specific use cases involving BO handle recycling and dma-buf import require assessment for potential vulnerability.
- Monitoring for updates on Linux kernel patches and vulnerability fixes is recommended.
Technical summary
The Linux kernel vulnerability involves a reference leak in the accel/amdxdna component. When the mapping of a chained BO fails, the reference is not properly dropped, leading to a leak. This issue is not typically encountered in ordinary use but can be exposed in specific scenarios involving BO handle recycling and dma-buf import. The vulnerability requires attention from Linux kernel developers, administrators, and users who utilize the accel/amdxdna component. Verification of kernel versions, assessment of specific use cases, and monitoring for patches are essential defensive actions. The CVE record and source references indicate a resolved Linux kernel vulnerability.
Defensive priority
Low priority, as ordinary use does not reach this issue; however, specific scenarios involving BO handle recycling and dma-buf import may expose the vulnerability.
Recommended defensive actions
- Review Linux kernel versions and configurations for exposure to the accel/amdxdna component
- Assess specific use cases involving BO handle recycling and dma-buf import for potential vulnerability
- Monitor for updates on Linux kernel patches and vulnerability fixes
- Perform a thorough review of the Linux kernel version used in your environment to identify potential exposure to the accel/amdxdna component vulnerability.
- Evaluate the impact of BO handle recycling and dma-buf import on your specific use cases and assess the potential vulnerability.
- Implement monitoring to detect any attempts to exploit the vulnerability in your environment.
- Maintain an inventory of assets that could be affected by this vulnerability and prioritize their remediation.
Evidence notes
The CVE record and source references indicate a resolved Linux kernel vulnerability. The issue involves a reference leak in the accel/amdxdna component. The CVE Program and NVD provide official records and vulnerability details.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-98144 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-98144
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-98144 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-98144
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/7e33ba3a1d48c2d20ed270dec9d2d08332585c8e
416baaa9-dc9f-4396-8d5f-8c081fb06d67
-
Source reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/eb90cb257e0792ac11f0347254bad3fc72417db6
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.