CVE-2026-45931

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Hold mm structure across iommu_sva_unbind_device() Some tests trigger a crash in iommu_sva_unbind_device() due to accessing iommu_mm after the associated mm structure has been freed. Fix this by taking an explicit reference to the mm structure after successfully binding the device, and releasing it only after the device is unbound. This ensures the mm remains valid for the entire SVA bind/unbind lifetime.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/a9162439ad792afcddc04718408ec1380b7a5f63	Patch
https://git.kernel.org/stable/c/f31ccf6278132a35a652fe5eeac3941e1e912398	Patch
https://git.kernel.org/stable/c/f6b4c1d98a7b8040d4d02e89425b3942016a2c2c	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

No history.

Information

Published : 2026-05-27 14:17

Updated : 2026-06-25 12:46

NVD link : CVE-2026-45931

Mitre link : CVE-2026-45931

CVE.ORG link : CVE-2026-45931

JSON object : View

Products Affected

linux

linux_kernel

CWE

NVD-CWE-noinfo

{"id": "CVE-2026-45931", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "be462c97b7dfd24999babe39cce3de224ebe1f80", "lessThan": "f6b4c1d98a7b8040d4d02e89425b3942016a2c2c", "versionType": "git"}, {"status": "affected", "version": "be462c97b7dfd24999babe39cce3de224ebe1f80", "lessThan": "f31ccf6278132a35a652fe5eeac3941e1e912398", "versionType": "git"}, {"status": "affected", "version": "be462c97b7dfd24999babe39cce3de224ebe1f80", "lessThan": "a9162439ad792afcddc04718408ec1380b7a5f63", "versionType": "git"}], "programFiles": ["drivers/accel/amdxdna/amdxdna_pci_drv.c", "drivers/accel/amdxdna/amdxdna_pci_drv.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"status": "unaffected", "version": "0", "lessThan": "6.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.14", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.4", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/accel/amdxdna/amdxdna_pci_drv.c", "drivers/accel/amdxdna/amdxdna_pci_drv.h"], "defaultStatus": "affected"}]}], "published": "2026-05-27T14:17:09.053", "references": [{"url": "https://git.kernel.org/stable/c/a9162439ad792afcddc04718408ec1380b7a5f63", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f31ccf6278132a35a652fe5eeac3941e1e912398", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f6b4c1d98a7b8040d4d02e89425b3942016a2c2c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Hold mm structure across iommu_sva_unbind_device()\n\nSome tests trigger a crash in iommu_sva_unbind_device() due to\naccessing iommu_mm after the associated mm structure has been\nfreed.\n\nFix this by taking an explicit reference to the mm structure\nafter successfully binding the device, and releasing it only\nafter the device is unbound. This ensures the mm remains valid\nfor the entire SVA bind/unbind lifetime."}], "lastModified": "2026-06-25T12:46:49.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C969BF0A-760D-435A-9705-6ED20216C1BB", "versionEndExcluding": "6.18.14", "versionStartIncluding": "6.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092", "versionEndExcluding": "6.19.4", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}