Junglewise Threat Intelligence

CVE-2026-74699: Linux kernel drm/xe memory leak in exec_queue_set_hang_replay_state

CVE-2026-74699 · Severity: info · Published 2026-08-22

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's graphics driver for Intel Xe GPUs contains a memory leak in the execution queue hang replay state handler. A local user with appropriate privileges can trigger the vulnerability by repeatedly calling the affected ioctl without properly freeing previously allocated memory, potentially exhausting system memory and causing a denial of service.

Technical details

A memory leak exists in the exec_queue_set_hang_replay_state() function within drivers/gpu/drm/xe/xe_exec_queue.c. The vulnerable code blindly overwrites the q->replay_state pointer without checking if it already contains a previously allocated block of memory from vmemdup_user(). This causes the previous allocation to become unreclaimable. The fix adds a simple validation check: if q->replay_state is not empty, the function returns -EINVAL, preventing the memory leak. The vulnerability is local in nature, requiring direct access to the ioctl interface. A patch was merged into the upstream Linux kernel addressing this issue.

Affected products

  • Linux Linux kernel 5.x - 7.x (affected drm/xe driver)

Timeline

  • 2026-08-22: disclosed: CVE-2026-74699 published
  • 2026-06-24: patched: Fix committed upstream as c5f500161709f27719701334190dff2325868ef0

References

Related threats