---
id: CVE-2026-74716
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()

  In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears
  VM_PFNMAP
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()

  In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears
  VM_PFNMAP. If an unprivil…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e486147c912f653ef4b60a6c7dbd4168a4c56a9f <
    618fc8dc219c11b8b85f0c8e3f7ff46cc1544339
  - >-
    Linux >= e486147c912f653ef4b60a6c7dbd4168a4c56a9f <
    13339132d89d00b513dff0730bff3a313b9b13b5
  - >-
    Linux >= e486147c912f653ef4b60a6c7dbd4168a4c56a9f <
    4a19f7ab5972ef608b31ae921419bc3e04b3f8ad
  - Linux 6.16
published: '2026-08-22'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:48.727'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74716'
references:
  - url: 'https://git.kernel.org/stable/c/13339132d89d00b513dff0730bff3a313b9b13b5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4a19f7ab5972ef608b31ae921419bc3e04b3f8ad'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/618fc8dc219c11b8b85f0c8e3f7ff46cc1544339'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00206
epssPercentile: 0.10632
ingestedAt: '2026-10-14T13:30:58.546Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()

In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears
VM_PFNMAP. If an unprivileged userspace process mmaps a non-imported GEM
object and then calls madvise(MADV_DONTNEED), the PTEs will be
successfully cleared because VM_MIXEDMAP allows this (unlike VM_PFNMAP).

When userspace subsequently accesses the memory, drm_gem_shmem_fault()
handles the page fault and attempts to map the backing shmem page via
vmf_insert_pfn() which calls vmf_insert_pfn_prot(). Because the backing
shmem page is normal system memory (pfn_valid(pfn) is true) and the VMA
now has VM_MIXEDMAP set, won't this predictably trigger the explicit
assertion BUG_ON((vma->vm_flags & VM_MIXEDMAP) && pfn_valid(pfn))

Fix by removing the vm_flags_mod() call and replacing the vm_insert_pages()
pre-population with the handle_mm_fault() loop that was already used for
the import (dma-buf) path.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.