In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix iommu domain lifetime race during device removal When force_iova mode is enabled, amdxdna_remove() frees xdna->domain. If amdxdna_gem_obj_free() is called after device removal, it may attempt to access xdna->domain, resulting in a use-after-free. Fix the race by adding freeing xdna->domain as a managed release action, so its lifetime is managed by DRM and remains valid until all managed resources are released.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80608 is a use-after-free vulnerability in the Linux kernel's AMD XDNA accelerator driver that occurs when force_iova mode is enabled. The vulnerability stems from improper lifetime management of the IOMMU domain object (xdna->domain), which is freed during device removal but may still be accessed by gem object cleanup routines running asynchronously. This affects systems running Linux kernels with AMD XDNA drivers enabled, particularly those utilizing GPU acceleration features. Attackers with local access could potentially trigger this race condition to cause kernel memory corruption, leading to denial of service or potential privilege escalation.
While this CVE lacks explicit MITRE ATT&CK technique mappings, Casky.ai's platform would correlate this vulnerability pattern with techniques related to resource manipulation and memory exploitation tactics. Security practitioners using Casky would identify this through behavioral analysis of kernel object lifecycle management, detecting improper synchronization between asynchronous cleanup operations and resource deallocation. The platform's extended reasoning capabilities would flag this as a race condition vulnerability requiring analysis of concurrency patterns, resource state management, and DRM (Direct Rendering Manager) subsystem interactions—enabling teams to assess whether their kernel configurations enable force_iova mode and prioritize patching accordingly.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80608. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation