Executive brief
The Linux kernel's graphics driver for Intel Xe GPUs contains a memory leak in the execution queue hang replay state handler. A local user with appropriate privileges can trigger the vulnerability by repeatedly calling the affected ioctl without properly freeing previously allocated memory, potentially exhausting system memory and causing a denial of service.
Technical details
A memory leak exists in the exec_queue_set_hang_replay_state() function within drivers/gpu/drm/xe/xe_exec_queue.c. The vulnerable code blindly overwrites the q->replay_state pointer without checking if it already contains a previously allocated block of memory from vmemdup_user(). This causes the previous allocation to become unreclaimable. The fix adds a simple validation check: if q->replay_state is not empty, the function returns -EINVAL, preventing the memory leak. The vulnerability is local in nature, requiring direct access to the ioctl interface. A patch was merged into the upstream Linux kernel addressing this issue.
Affected products
- Linux Linux kernel 5.x - 7.x (affected drm/xe driver)
Timeline
- 2026-08-22: disclosed: CVE-2026-74699 published
- 2026-06-24: patched: Fix committed upstream as c5f500161709f27719701334190dff2325868ef0