EUVD-2026-59566
GHSA-qxcv-w487-mjhg
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Local access required with low privileges to open the accelerator device; overflow of copy_to_user yields kernel data exposure (C:H) and user-space buffer corruption (I:H).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Adjust size for copy_to_user()
The amount of data returned to user space should be limited by the buffer size provided by the application. If the buffer is smaller than the data size, return only the portion that fits instead of failing.
AnalysisAI
Improper bounds enforcement in the Linux kernel's accel/amdxdna driver allows a local low-privileged user to trigger a kernel-to-userspace copy that exceeds the application-provided buffer size via a crafted ioctl call. The root cause is that copy_to_user() was using the kernel's internal data size rather than the caller-supplied buffer size to bound the copy, enabling overflow into adjacent userspace memory and exposure of unintended kernel data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target system must be running a Linux kernel version that includes the vulnerable amdxdna driver (commit 850d71f6bf4c present, fix commits absent) on hardware equipped with an AMD XDNA NPU (Ryzen AI-series processor). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate-to-low despite the 7.3 CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with low privileges on a workstation equipped with an AMD Ryzen AI processor opens the amdxdna accelerator device node and issues an ioctl with a carefully sized destination buffer smaller than the kernel's internal data structure. The kernel copies beyond the application buffer, spilling adjacent kernel data into user space or overwriting adjacent user-space memory, which an attacker could leverage to leak kernel addresses or corrupt process memory. … |
| Remediation | Apply the upstream fix by upgrading to Linux kernel 7.1.5 or 7.2-rc1, which include the corrected copy_to_user() size logic for the amdxdna driver. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: scan infrastructure to identify systems with the Linux accel/amdxdna driver loaded and create a prioritized patch list by criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today