Executive brief
A memory leak vulnerability was identified in the Linux kernel's Intel Xe graphics driver. This flaw occurs when the system fails to properly release memory during certain internal operations, which could allow a local user to gradually exhaust system resources. If exploited, this could lead to system instability or a complete crash, impacting the availability of the affected machine.
Technical details
A memory leak vulnerability exists in the Intel Xe graphics driver (drm/xe) within the Linux kernel, specifically in the 'xe_reg_sr_add' function in 'drivers/gpu/drm/xe/xe_reg_sr.c'. The root cause is a failure to call 'kfree()' on a newly allocated entry when the 'xa_store()' operation fails. An attacker with local access could trigger this error path repeatedly to exhaust kernel memory, leading to a denial of service (DoS). The issue has been resolved by adding a proper error handling path that releases the allocated memory upon failure.
Affected products
- Linux Linux Kernel 6.14 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-03: advisory: Initial disclosure of CVE-2026-23418
- 2026-03-12: patched: Fix committed to stable kernel branches