CVE-2026-45931

HighCVSS 7.8/10Last modified Jun 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Hold mm structure across iommu_sva_unbind_device()

Some tests trigger a crash in iommu_sva_unbind_device() due to accessing iommu_mm after the associated mm structure has been freed.

Fix this by taking an explicit reference to the mm structure after successfully binding the device, and releasing it only after the device is unbound. This ensures the mm remains valid for the entire SVA bind/unbind lifetime.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= be462c97b7dfd24999babe39cce3de224ebe1f80, < f6b4c1d98a7b8040d4d02e89425b3942016a2c2c; >= be462c97b7dfd24999babe39cce3de224ebe1f80, < f31ccf6278132a35a652fe5eeac3941e1e912398; >= be462c97b7dfd24999babe39cce3de224ebe1f80, < a9162439ad792afcddc04718408ec1380b7a5f63
LinuxLinux6.14

References

Timeline

Published
May 27, 2026
Last modified
Jun 25, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-459327.3In the Linux kernel, the following vulnerability has been resolved: bpf: Fix tcx/netkit detach permissions when prog fd isn't given This cCVE-2026-459337.8In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve id of register in sync_linked_regs() sync_linked_regs() CVE-2026-459345.5In the Linux kernel, the following vulnerability has been resolved: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocationCVE-2026-459357.8In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot In the 'CVE-2026-459367.8In the Linux kernel, the following vulnerability has been resolved: power: supply: goldfish: Fix use-after-free in power_supply_changed() CVE-2026-459375.5In the Linux kernel, the following vulnerability has been resolved: crypto: inside-secure/eip93 - fix kernel panic in driver detach DuringCVE-2026-459387.8In the Linux kernel, the following vulnerability has been resolved: power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()CVE-2026-459395.5In the Linux kernel, the following vulnerability has been resolved: gpib: Fix memory leak in ni_usb_init() In ni_usb_init(), if ni_usb_setCVE-2026-45947.3A vulnerability has been found in erupts erupt up to 1.13.3. Affected by this issue is the function geneEruptHqlOrderBy of the file erupt-daCVE-2026-459405.5In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix oops when split header is enabled For GMAC4, when splCVE-2026-459415.5In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure gCVE-2026-459427.8In the Linux kernel, the following vulnerability has been resolved: ext4: fix e4b bitmap inconsistency reports A bitmap inconsistency issu
CVE-2026-45931: High severity, CVSS 7.8 | Vulnix