Executive brief
A vulnerability was identified in the Linux kernel's Intel GPU driver (Xe) that could allow a local user to cause a system malfunction. The issue occurs when the system fails to properly clean up memory and resources during certain internal operations, leading to resource leaks. Over time, this could result in a denial-of-service condition, impacting the stability and availability of systems using Intel graphics hardware.
Technical details
A resource management vulnerability exists in the Linux kernel's Intel Xe DRM driver within the xe_sync_entry_parse() function. The function can allocate various references (such as syncobj, fence, or chain fence) but fails to release them if a subsequent error occurs during the parsing process. These error paths return directly without calling xe_sync_entry_cleanup(), resulting in reference leaks (CWE-459). A local attacker with access to the GPU device could potentially exploit this to exhaust kernel memory or resources, leading to a denial-of-service. The issue has been resolved by routing error paths through a common cleanup label.
Affected products
- Linux Linux Kernel 6.8 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1
Timeline
- 2026-05-08: advisory: Initial CVE publication
- 2026-02-23: patched: Initial fix committed to mainline kernel