https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:35:32 +0000 https://vulnerability.circl.lu/vuln/cve-2026-72090 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>accel/amdxdna: Use caller client for debug BO sync</p> <p>amdxdna_drm_sync_bo_ioctl() looks up args-&gt;handle in the ioctl caller&#39;s drm_file. For SYNC_DIRECT_FROM_DEVICE, it then calls amdxdna_hwctx_sync_debug_bo(), but passes abo-&gt;client.</p> <p>amdxdna_hwctx_sync_debug_bo() uses the passed client both as the handle namespace for debug_bo_hdl and as the owner of the hardware context xarray. Those must match the file that supplied args-&gt;handle. The BO&#39;s stored client pointer is object state, not the ioctl context.</p> <p>Pass filp-&gt;driver_priv instead, matching the original handle lookup.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>accel/amdxdna: Use caller client for debug BO sync</p> <p>amdxdna_drm_sync_bo_ioctl() looks up args-&gt;handle in the ioctl caller&#39;s drm_file. For SYNC_DIRECT_FROM_DEVICE, it then calls amdxdna_hwctx_sync_debug_bo(), but passes abo-&gt;client.</p> <p>amdxdna_hwctx_sync_debug_bo() uses the passed client both as the handle namespace for debug_bo_hdl and as the owner of the hardware context xarray. Those must match the file that supplied args-&gt;handle. The BO&#39;s stored client pointer is object state, not the ioctl context.</p> <p>Pass filp-&gt;driver_priv instead, matching the original handle lookup.</p> https://vulnerability.circl.lu/vuln/cve-2026-72090