---
id: CVE-2026-74716
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()

  In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears
  VM_PFNMAP
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()

  In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears
  VM_PFNMAP. If an unprivil…
severity: none
published: '2026-08-22'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74716'
references:
  - url: 'https://git.kernel.org/stable/c/13339132d89d00b513dff0730bff3a313b9b13b5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4a19f7ab5972ef608b31ae921419bc3e04b3f8ad'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00198
epssPercentile: 0.08868
ingestedAt: '2026-10-14T13:30:58.546Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()

In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears
VM_PFNMAP. If an unprivileged userspace process mmaps a non-imported GEM
object and then calls madvise(MADV_DONTNEED), the PTEs will be
successfully cleared because VM_MIXEDMAP allows this (unlike VM_PFNMAP).

When userspace subsequently accesses the memory, drm_gem_shmem_fault()
handles the page fault and attempts to map the backing shmem page via
vmf_insert_pfn() which calls vmf_insert_pfn_prot(). Because the backing
shmem page is normal system memory (pfn_valid(pfn) is true) and the VMA
now has VM_MIXEDMAP set, won't this predictably trigger the explicit
assertion BUG_ON((vma->vm_flags & VM_MIXEDMAP) && pfn_valid(pfn))

Fix by removing the vm_flags_mod() call and replacing the vm_insert_pages()
pre-population with the handle_mm_fault() loop that was already used for
the import (dma-buf) path.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.