Linux Kernel CVE-2026-98145

Requires: (1) the amdxdna NPU accelerator driver present and bound, i.e. a host with AMD XDNA / Ryzen AI NPU hardware; (2) local access sufficient to open the amdxdna render node - EXEC_CMD is reachable by any process that can open the render node, consistent with PR:L; and (3) issuing a command-chain submission whose command_count field is set to zero. The faulting code path is further gated by firmware: on firmware without AIE2_NPU_COMMAND, op stays ERT_INVALID_CMD and aie2_get_npu_chain_msg_op() still returns MSG_OP_CHAIN_EXEC_NPU, so the submission proceeds to the zero-length drm_clflush_virt_range and faults on the vmap guard page. Limiting factors that reduce realistic risk: local-only vector (no network reach), dependence on the specialized amdxdna driver and underlying AMD NPU hardware, and the firmware condition above; impact is confined to a kernel crash with no confidentiality or integrity effect.

This is a local availability-only issue, not a remote or high-urgency one. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes an out-of-bounds read (CWE-125) reachable by any local process that can open the amdxdna render node, with impact limited to a kernel crash (A:H) and no confidentiality or integrity effect (C:N/I:N). The signals are mutually consistent and point to low real-world priority: EPSS is 0.14% (3rd percentile), the vulnerability is NOT on the CISA KEV list (no confirmed active exploitation), and no proof-of-concept or exploit reference is supplied - the only references are the two kernel.org stable fix commits. The vuln.today decision label is 'this_month', i.e. patch on a normal maintenance cadence rather than emergency. One cross-source discrepancy to note: the input Tags include 'Information Disclosure', but the CVSS confidentiality metric is C:N and the described behavior is a read of the byte before the buffer that faults on a guard page - i.e. a denial of service, not data disclosure; treat the disclosure tag as inaccurate. Exploitation also depends on firmware behavior (the faulting path is reached on firmware without AIE2_NPU_COMMAND via aie2_get_npu_chain_msg_op), which further narrows realistic impact.

On a system with the AMD XDNA NPU (amdxdna) driver loaded, a local user who can open the render node issues an EXEC_CMD submitting a command chain whose command_count is zero. struct_size(payload, data, 0) still passes the payload length check, so a zero-length buffer is submitted and drm_clflush_virt_range(cmd_buf, 0) reads the byte before the buffer, faulting on the vmap guard page and crashing the kernel. No public exploit identified at time of analysis; the only references are the upstream fix commits.