Executive brief
The Linux kernel's Intel Xe GPU driver contains a memory leak in its performance monitoring (OA) configuration code. When configuration operations fail, the driver fails to properly clean up allocated memory and fence references, causing a gradual loss of system memory until the next configuration change overwrites the leaked data. This can lead to system instability and denial of service over time.
Technical details
This is a resource cleanup vulnerability in the Intel Xe DRM driver's OA (Observation Architecture) subsystem. The function xe_oa_emit_oa_config() releases sync entries and the syncs array only on success; when it fails before a critical point (fence allocation, config buffer allocation, or batch submission), it returns without freeing stream->syncs. The stream open path handles such failures with proper cleanup in the caller, but xe_oa_config_locked() propagates the error without cleanup, causing the syncs array and associated fence references to leak. The next config ioctl call overwrites stream->syncs, making the leaked memory unreachable. The fix adds cleanup code matching the stream open error path behavior.
Affected products
- Linux Linux kernel various versions with drm/xe driver support
Timeline
- 2026-09-04: disclosed
- 2026-08-13: patched