In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain struct amdxdna_cmd_chain contains a flexible array annotated with __counted_by(command_count). Since the structure is stored in shared AMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently. If command_count is changed to zero, the bounds check generated from __counted_by may fail and trigger a kernel panic. Remove __counted_by to avoid relying on the userspace-controlled command_count for the flexible array bounds check.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://git.kernel.org/stable/c/52f3e086760a9a3e02a46a10b57caffd73b1c204 Patch
- https://git.kernel.org/stable/c/93fa3e925b15b0ded0a549fe7f12bfbb1c4e171a Patch
- https://git.kernel.org/stable/c/b3709d354545e70388177500761f92d906c4dfd6 Patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 7
- CwesCWE-362NVD modified 2026-10-22 00:45
- StatusUndergoing Analysis → AnalyzedNVD modified 2026-10-22 00:45
- Cpes+2 CPE criteria (now 2)NVD modified 2026-10-21 19:51
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-21 19:51
- CVSS5.5 (v3.1, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)NVD modified 2026-10-21 19:51
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-19 09:14
- First seenunscoredNVD modified 2026-10-19 10:18
Affected (CPE criteria) 2
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*