Linux Kernel EUVD-2026-55566

The amdxdna driver in the Linux kernel supports AMD XDNA neural processing unit (NPU) accelerators, such as those found in Ryzen AI (Strix Point) silicon, integrated with the DRM (Direct Rendering Manager) scheduler subsystem. The root cause is improper mm_struct lifecycle management: amdxdna_cmd_submit() captures current->mm - the memory descriptor of the calling task - and stores it as a raw pointer in the job structure without incrementing mm_count via mmgrab(). The DRM scheduler later calls aie2_sched_job_run() from a kernel worker thread to execute the job, but if the originating process has exited by that point, do_exit() will have called mmput() and potentially dropped the mm_count to zero, freeing the mm_struct. The subsequent dereference of job->mm in the worker thread constitutes a classic use-after-free (CWE-416) with a race window between process teardown and deferred kernel-thread execution. The upstream fix applies mmgrab() at submission time and mmdrop() in every corresponding cleanup and completion path, ensuring the mm_struct is not released until the job is fully retired.