Executive brief
A vulnerability in the Linux kernel's Intel Xe graphics driver could allow a local user to cause a memory leak. By repeatedly triggering a specific error condition when opening a performance monitoring stream, an attacker could exhaust system resources. This occurs because the system fails to properly release internal references to graphics execution queues, potentially leading to system instability or a denial-of-service over time.
Technical details
A resource leak exists in the xe_oa_stream_open_ioctl() function within drivers/gpu/drm/xe/xe_oa.c. When the 'width' parameter of an execution queue is greater than 1, the function returns -EOPNOTSUPP without jumping to the 'err_exec_q' cleanup label. This bypasses the necessary reference count decrement for the exec_queue object obtained via xe_exec_queue_lookup(). Because the exec_queue holds a reference to the xe_file, and the leaked reference is not tracked in the file's xarray, the memory remains pinned even after the file descriptor is closed. This can be exploited by a local user to cause a kernel memory leak. The issue has been resolved in various stable branches including 6.18.34 and 7.0.11.
Affected products
- Linux Linux 6.13, 6.18.34, 7.0.11
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory