CVE-2026-98146

What it actually does

Race condition in amdxdna_cmd_chain flexible array bounds check allows userspace to concurrently set command_count to zero in shared memory, defeating __counted_by and triggering kernel panic on access.

Why it matters to the business

Local authenticated users can crash the system, causing denial of service and loss of availability on affected Linux kernels; low exploit likelihood reduces immediate risk but still requires patching within standard maintenance windows.

How an attack unfolds

An attacker with local access maps the shared AMDXDNA_BO_SHARE buffer, races to modify command_count to zero while the kernel performs the bounds-checked access, and forces the kernel panic handler to terminate the process or reboot.

How to fix it

Upgrade to a Linux kernel containing the commit that removes __counted_by from struct amdxdna_cmd_chain; rebuild and deploy the updated kernel package across affected systems.

How to confirm the fix worked

Confirm the amdxdna source no longer annotates the flexible array with __counted_by(command_count) and that the driver initializes and accesses the structure without relying on the userspace-controlled field for bounds checks.

Typical attack path

1. Obtain local user access on a system running a vulnerable kernel with amdxdna driver loaded
2. Map the shared memory region containing amdxdna_cmd_chain
3. Concurrently modify command_count to zero while kernel code evaluates the flexible array bounds
4. Trigger the code path that performs the now-invalid bounds-checked access
5. Observe kernel panic and resulting denial of service

How to detect it

Review kernel logs for amdxdna-related panic messages or oops traces involving command_count or flexible array bounds; correlate with process activity that maps AMDXDNA_BO_SHARE regions shortly before the crash.

What your security team should do

• Prioritize kernel updates in the next scheduled patch cycle given the 28-day publication window and stable low EPSS
• Restrict local access to systems using the amdxdna driver until patched
• Monitor vendor kernel changelogs for backports to supported distribution releases