CVE-2026-72331 is a use-after-free in the amdxdna GPU driver where a vm_area_struct pointer saved in one operation is dereferenced in another after the VMA's lifetime may have ended. The fix removes the cached VMA reference entirely rather than implementing proper lifetime tracking—and that choice tells you everything about this vulnerability class.
The VMA saved-pointer pattern is a known hazard in kernel driver development, but it keeps recurring because the kernel's VMA API provides no safe mechanism for drivers to maintain persistent references. VMAs can be destroyed, split, merged, or relocated by various VM operations, and driver code that holds pointers across these operations will corrupt state unpredictably. The amdxdna driver attempted to cache state that cannot safely be cached—a design-level mistake, not merely an oversight.
The deeper problem is that hardware abstraction requires correlating CPU virtual addresses with device-side address spaces, and VMAs are the natural source of that information. But the kernel's VMA model is optimized for the core VM subsystem, not for drivers needing persistent relationships. The 'safe path' (proper lifetime tracking via vma_lock_anon_vma or similar) requires additional non-obvious calls, while the dangerous path (save the pointer) compiles cleanly. The API is ergonomically biased toward failure.
This pattern almost certainly exists in other kernel subsystems. Any driver that saves a vm_area_struct pointer across operations triggering mm_struct changes (mappings, munmap, fork, exec, exit) is potentially vulnerable. The remediation is straightforward: remove cached VMA references entirely, as the fix demonstrates. But the next accelerator driver author will face the same design pressure, and without kernel-provided stable VMA reference types with explicit lifetime tracking, the cycle will repeat.