Executive brief
The Linux kernel's DRM Xe graphics driver contains a double-free vulnerability in the hardware engine initialization error path. During probe failure, the code explicitly frees a managed buffer object that is already scheduled for automatic cleanup, causing memory corruption. This can lead to kernel panics or system instability when hardware engine initialization fails.
Technical details
The vulnerability is a use-after-free / double-free bug in the hw_engine_init() function in drivers/gpu/drm/xe/xe_hw_engine.c. A managed buffer object (BO) allocated via xe_managed_bo_create_pin_map() automatically registers a devm cleanup action. The error path then explicitly frees the same BO via xe_bo_unpin_map_no_vm(), causing a double-free when devm unwinds during device probe failure. The vulnerable code path is only triggered during hardware engine initialization failures, requiring no special authentication or network access. The fix removes the explicit free and relies on the devm mechanism, consistent with other xe_managed_bo_create_pin_map() call sites. Patches are available in Linux kernel stable tree commits.
Affected products
- Linux Linux kernel affected versions include Linux 5.x and 6.x series up to approximately 6.12
Timeline
- 2026-08-15: disclosed