In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain
struct amdxdna_cmd_chain contains a flexible array annotated with
__counted_by(command_count). Since the structure is stored in shared
AMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently.
If command_count is changed to zero, the bounds check generated from
__counted_by may fail and trigger a kernel panic.
Remove __counted_by to avoid relying on the userspace-controlled
command_count for the flexible array bounds check.
References
Configurations
Configuration 1 (hide)
|
History
22 Oct 2026, 00:45
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-362 |
21 Oct 2026, 19:51
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
|
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | () https://git.kernel.org/stable/c/52f3e086760a9a3e02a46a10b57caffd73b1c204 - Patch | |
| References | () https://git.kernel.org/stable/c/93fa3e925b15b0ded0a549fe7f12bfbb1c4e171a - Patch | |
| References | () https://git.kernel.org/stable/c/b3709d354545e70388177500761f92d906c4dfd6 - Patch |
25 Sep 2026, 11:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-25 11:17
Updated : 2026-10-22 00:45
NVD link : CVE-2026-98146
Mitre link : CVE-2026-98146
CVE.ORG link : CVE-2026-98146
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')