Executive brief
A vulnerability was identified in the Linux kernel's Intel Xe graphics driver. The issue occurs during the creation of execution queues, where certain internal errors could lead to the system keeping references to memory that has already been deleted. This could potentially result in a system crash or allow an attacker to destabilize the operating system.
Technical details
A use-after-free vulnerability exists in the xe_exec_queue_create_ioctl() function within the Intel Xe DRM driver (drivers/gpu/drm/xe/xe_exec_queue.c). The flaw stems from two improper error-handling paths: first, failing to call xe_exec_queue_kill() when xe_hw_engine_group_add_exec_queue() fails, leaving a dangling pointer in the VM's compute list; and second, failing to remove a queue from the hardware engine group if xa_alloc() fails. A local attacker could potentially exploit these dangling pointers to cause a kernel panic or achieve arbitrary code execution. The issue has been resolved by ensuring proper cleanup labels are reached during IOCTL failure scenarios.
Affected products
- Linux Linux Kernel 6.12, 7.0, 7.1
Timeline
- 2026-04-08: other: Patch authored
- 2026-04-29: other: Patch committed to mainline
- 2026-06-24: disclosed: CVE published