CVE-2026-72328

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Exploitation requires local DRM ioctls (AMDXDNA_EXEC_CMD) and mmap/munmap on the AMD XDNA NPU accel node (/dev/accel/accel* or renderD*); there is no network, adjacent-radio, or physical-bus path to aie2_populate_range().

AC:LAttack complexity, low

This is a lifetime race between munmap-driven amdxdna_umap_release() and command-submit-driven aie2_populate_range(); the attacker controls both sides with concurrent threads (unmap/invalidate vs EXEC_CMD), so no timing or state outside attacker control is required.

PR:LPrivileges required, low

Vulnerable ioctls (CREATE_BO, EXEC_CMD, mmap) are registered with DRM_IOCTL_DEF_DRV flags 0 (no DRM_ROOT_ONLY/DRM_AUTH); any unprivileged local user permitted to open the AMD NPU accel device on Ryzen AI systems can trigger the race.

UI:NUser interaction, none

The attacker opens the device, maps buffer objects, and races munmap/invalidation against their own EXEC_CMD submissions; no separate victim user action or interaction is required.

S:UScope, unchanged

The use-after-free corrupts kernel heap objects within the same kernel security authority; it is not a VM escape, hypervisor breakout, or IOMMU DMA-boundary bypass as a direct consequence of the flaw.

C:HConfidentiality impact, high

Use-after-free of kmalloc amdxdna_umap lets attacker-controlled heap spray reclaim freed notifier/range metadata; subsequent hmm_range_fault() and mm_struct dereferences enable arbitrary kernel memory disclosure.

I:HIntegrity impact, high

UAF on amdxdna_umap gives attacker control over hmm_range and PFN tables used before NPU job submission, enabling heap grooming for arbitrary kernel writes and control-flow hijack toward local privilege escalation.

A:HAvailability impact, high

The race dereferences and mutates freed amdxdna_umap and associated mm_struct/hmm_range state, reliably causing kernel oops/panic; repeated concurrent unmap/submit cycles sustain denial of service on the NPU host.