Linux amdxdna Driver CVE-2026-98146

Requires a local authenticated user (PR:L) on a system that has AMD XDNA NPU hardware with the accel/amdxdna kernel driver loaded. The attacker must be able to allocate an AMDXDNA_BO_SHARE shared buffer object holding a struct amdxdna_cmd_chain and submit a command chain, then concurrently modify the userspace-controlled command_count field in that shared memory (a race) so the __counted_by(command_count) bounds check fails. Limiting factors: no remote vector (AV:L), requires the specific AMD NPU hardware and driver to be present and accessible, requires local access rather than network reachability, and yields only a crash - no code execution, data disclosure, or integrity impact.

This is a genuine but low-urgency issue. All signals agree on a modest, local denial-of-service risk rather than a top priority. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms the flaw is only reachable by an already-authenticated local user (PR:L), with no confidentiality or integrity impact and availability-only consequences (kernel panic). EPSS is very low at 0.15% (4th percentile), consistent with the local-only vector and the narrow hardware requirement. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is neither actively exploited nor weaponized. The one notable data conflict is the input tag 'Information Disclosure,' which contradicts the CVSS impact metrics (C:N/I:N/A:H) - this is a race-condition denial-of-service bug, not an information-disclosure issue, and the tag appears mislabeled. Overall this is a correctly-rated MEDIUM (5.5) local DoS, not a high-CVSS-low-real-risk inflation nor an underrated threat; its real-world reach is constrained by the need for both local access and AMD XDNA NPU hardware with the amdxdna driver loaded.

A local, low-privileged user on a system with an AMD XDNA NPU and the amdxdna accelerator driver allocates an AMDXDNA_BO_SHARE buffer object containing an amdxdna_cmd_chain structure, then concurrently rewrites the userspace-controlled command_count field (e.g., to zero) while the kernel processes the command chain. The __counted_by bounds check derived from that attacker-mutable field fails and triggers a kernel panic, crashing the host. No public exploit is identified at time of analysis, and exploitation requires local access plus the specific AMD NPU hardware/driver.