# CVE-2026-89978: accel/amdxdna: return early from a zero-length flush

CVE-2026-89978 is fixed in linux on 1 platform by DEBIAN-CVE-2026-89978 (version 7.2.6-1), released September 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-89978
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0021
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 16, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-89978

## Description

In the Linux kernel, the following vulnerability has been resolved:  accel/amdxdna: return early from a zero-length flush  SYNC_BO does not constrain its size, so a request for zero bytes reaches drm_clflush_virt_range(), which ends with an unconditional clflushopt(end - 1). For an empty range that is the byte before the mapping, and abo->mem.kva comes from vmap(), so the access lands in the guard page below the vmalloc area and faults:    BUG: unable to handle page fault for address: ffffd16fbbc70fff   #PF: supervisor read access in kernel mode   Oops: Oops: 0000 [#1] SMP NOPTI   CPU: 7 UID: 1000 Comm: sync_bo_probe   RIP: 0010:drm_clflush_virt_range+0x3c/0x70   Call Trace:    amdxdna_drm_sync_bo_ioctl+0x124/0x430 [amdxdna]    drm_ioctl+0x301/0x4c0    __x64_sys_ioctl+0x115/0x2f0    do_syscall_64+0xa6/0x3d0  Any process that can open the render node can do this. Reproduced 3 of 3 times on a Strix Point NPU (1022:17f0), by calling SYNC_BO with size 0 on an AMDXDNA_BO_SHARE object. The import arm takes the same request but flushes the whole scatterlist, so it survives it.  Nothing needs flushing for an empty range, so answer before choosing a path.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.6-1 | [DEBIAN-CVE-2026-89978](https://patchblox.com/security/data/fix/linux/debian-cve-2026-89978.md) | Sep 23, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.