Linux Kernel EUVD-2026-59227

The vulnerability is located in the accel/amdxdna kernel subsystem, which provides the Linux driver for AMD's XDNA Neural Processing Unit (NPU) found in Ryzen AI-class APUs such as Phoenix and Hawk Point. The root cause is a classic time-of-check/time-of-use (TOCTOU) memory safety flaw: amdxdna_umap_release() invokes the blocking mmu_interval_notifier_remove() - which blocks until all MMU notifier callbacks complete - and only then removes the umap object from abo->mem.umap_list. During that blocking window, a concurrent call to aie2_populate_range() can traverse the list and acquire a reference to the object already undergoing teardown, producing a use-after-free. The upstream fix replaces the naive reference acquisition with kref_get_unless_zero(), which atomically checks and increments the reference count, causing the concurrent caller to skip the object if its refcount has already reached zero. CPE data (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) confirms the affected product is the mainline Linux kernel. No CWE was formally assigned, but this maps to CWE-416 (Use After Free) with a concurrent trigger mechanism analogous to CWE-362 (Race Condition).