Executive brief
A vulnerability in the Linux kernel's Intel GPU driver (Xe) could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs during the handling of shared memory buffers between different graphics components, where a timing race condition can lead to the use of memory that has already been freed. This primarily impacts system stability and the security of data processed by the graphics hardware.
Technical details
A race condition exists in the 'xe_gem_prime_import' function within the 'drivers/gpu/drm/xe/xe_dma_buf.c' component of the Linux kernel. The vulnerability stems from the driver attaching a buffer object (BO) to the dma-buf list before it is fully initialized. This allows an exporter driver (such as amdgpu) to trigger an 'invalidate_mappings' hook on an uninitialized or 'empty' BO. If initialization fails and the BO is freed while still attached, a Use-After-Free (UAF) occurs. Attackers with local access could exploit this race to cause a kernel panic (NULL pointer dereference) or potentially achieve local privilege escalation. The fix involves reordering operations to ensure the BO is fully initialized before it is made visible via attachment.
Affected products
- Linux Linux Kernel 6.8 to 6.9.x
Timeline
- 2026-05-08: other: Initial patch authored
- 2026-06-24: disclosed: CVE published