CVE-2026-72093

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Fix use-after-free in amdxdnagemdmabuf_mmap()

When vminsertpages() fails, the error path calls vma->vmops->close(vma) which internally calls drmgemvmclose() → drmgemobjectput(), releasing the GEM object reference acquired at the start of the function. However, the closevma label then falls through to putobj, which calls drmgemobjectput() a second time on the same object.

If the first put releases the last reference, the object is freed and the second put accesses freed memory, causing a use-after-free.

Fix by returning directly from closevma instead of falling through to putobj, since the close handler already performs all necessary cleanup including the object put.