CVE-2026-98146

MediumCVSS 5.5/10Last modified Oct 22, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain

struct amdxdna_cmd_chain contains a flexible array annotated with __counted_by(command_count). Since the structure is stored in shared AMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently. If command_count is changed to zero, the bounds check generated from __counted_by may fail and trigger a kernel panic.

Remove __counted_by to avoid relying on the userspace-controlled command_count for the flexible array bounds check.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Sep 25, 2026
Last modified
Oct 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-98147In the Linux kernel, the following vulnerability has been resolved: printk: Don't WARN on kthread_run failure. Since __kthread_create_on_nCVE-2026-98148In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUD_ROTATION_0 is present in supported rotations TheCVE-2026-981497.8In the Linux kernel, the following vulnerability has been resolved: bpf: Fix percpu map update indexing with sparse CPU IDs Per-CPU array,CVE-2026-98156.5The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action whCVE-2026-981507.0In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPF_F_CPU validation for sparse CPU IDs BPF_F_CPU stores the CVE-2026-981515.5In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic TaCVE-2026-981525.5In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pendiCVE-2026-981535.5In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvme_query_fdp_info() CVE-2026-981547.0In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_CVE-2026-981557.1In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() AlthCVE-2026-981567.8In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV doCVE-2026-981575.5In the Linux kernel, the following vulnerability has been resolved: EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
CVE-2026-98146: Medium severity, CVSS 5.5 | Vulnix