Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-52976

drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() Two error handling issues exist in xe_exec_queue_create_ioctl(): 1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in preempt fence mode, xe_vm_add_compute_exec_queue() has already added the queue to the VM's compute exec queue list. Skipping the kill leaves the queue on that list, leading to a dangling pointer after the queue is freed. 2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has succeeded, the error path does not call xe_hw_engine_group_del_exec_queue() to remove the queue from the hw engine group list. The queue is then freed while still linked into the hw engine group, causing a use-after-free. Fix both by: - Changing the xe_hw_engine_group_add_exec_queue() failure path to jump to kill_exec_queue so that xe_exec_queue_kill() properly removes the queue from the VM's compute list. - Adding a del_hw_engine_group label before kill_exec_queue for the xa_alloc() failure path, which removes the queue from the hw engine group before proceeding with the rest of the cleanup. (cherry picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8)

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 7970cb36966c9b9183255dc097ae0446300eebcf to < f93b00161213a0fe9f7ff1d8498ee5ca9e0a5c43affected
  • 7970cb36966c9b9183255dc097ae0446300eebcf to < 753b149d5a433eb19e0c1b0eb4526a6e26120d1faffected
  • 7970cb36966c9b9183255dc097ae0446300eebcf to < 1be55646d8a2035343b012dcb12210db7bb8b056affected
  • 7970cb36966c9b9183255dc097ae0446300eebcf to < f3cc22d4df3ed58439ea7e21daa54c3608e03b78affected

Linux Linux

Default version status: affected

  • 6.12affected
  • 0 to < 6.12unaffected
  • 6.12.91 to ≤ 6.12.*unaffected
  • 6.18.33 to ≤ 6.18.*unaffected
  • 7.0.10 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References