Executive brief
A vulnerability was identified in the Linux kernel's Intel Xe graphics driver during the initialization of hardware virtualization features. If the system fails to set up certain management interfaces (sysfs), it may incorrectly attempt to clean up uninitialized memory, leading to a system crash or instability. This primarily affects servers or workstations using Intel GPUs with SR-IOV virtualization enabled.
Technical details
A vulnerability exists in the drm/xe/pf driver component of the Linux kernel. When devm_add_action_or_reset() fails during sysfs initialization, the cleanup handler (action_put_kobject) is triggered on a kobject that has not yet been initialized via kobject_init(). This leads to a kobject_put() call on a null or uninitialized object, resulting in a reference count underflow and a potential use-after-free scenario. The fix involves reordering the initialization sequence to ensure kobject_init() is called before registering the device-managed cleanup action. Additionally, the patch addresses a memory leak where the parent kobject was incorrectly passed during cleanup registration in the SR-IOV tree setup.
Affected products
- Linux Linux Kernel 6.12, 6.13, 6.14
Timeline
- 2026-02-04: patched: Initial fix authored by Intel
- 2026-06-03: advisory: CVE published by kernel.org