The Linux kernel vulnerability CVE-2026-72090 concerns the AMD XDNA acceleration driver's ioctl handler amdxdna_drm_sync_bo_ioctl(). The function looked up a handle in the ioctl caller's drm_file context but then called amdxdna_hwctx_sync_debug_bo() with a different client pointer (abo->client) instead of the caller's client context. Since amdxdna_hwctx_sync_debug_bo() uses the client both as the namespace for debug buffer object handles and as the owner of the hardware context xarray, this mismatch could cause inconsistencies or incorrect access control. The fix involved passing filp->driver_priv (the ioctl caller's client) to maintain correct context alignment.

The vulnerability could lead to incorrect synchronization of debug buffer objects due to client context mismatches, potentially causing unauthorized access or corruption within the AMD XDNA driver's hardware context management. However, no known exploits in the wild have been reported, and the impact details such as privilege escalation or denial of service are not explicitly stated.

A fix for this vulnerability has been implemented in the Linux kernel by correcting the client context passed to amdxdna_hwctx_sync_debug_bo() to match the ioctl caller's context. Users should apply the official Linux kernel updates that include this patch once available. Patch status is not yet confirmed in the provided data; check the vendor or Linux kernel advisory for current remediation guidance.