CVE-2026-23162
Double-Free Vulnerability in Linux Kernel drm/xe/nvm Component
Publication date: 2026-02-14
Last updated on: 2026-03-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.17 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.17.1 (inc) to 6.18.9 (exc) |
| linux | linux_kernel | 6.17 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-415 | The product calls free() twice on the same memory address. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a double-free error in the Linux kernel's drm/xe/nvm component. It occurs when the system attempts to free the same memory twice during the initialization and failure handling of an auxiliary device. Specifically, after a successful auxiliary_device_init(), the release callback frees the memory. However, if auxiliary_device_add() fails, the failure path also triggers a release callback that frees the same memory again, causing a double-free.
The fix involved moving the memory free operation (kfree) into the failure path of auxiliary_device_init() and removing the erroneous error handling path that caused the double-free.
How can this vulnerability impact me? :
A double-free vulnerability in the kernel can lead to undefined behavior, including system crashes, memory corruption, and potential escalation of privileges. Exploiting this flaw could allow an attacker to execute arbitrary code or cause denial of service by crashing the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a double-free error in the Linux kernel module xe_nvm, which can be detected by kernel debugging tools that monitor memory errors.
Specifically, kernel logs may show KASAN (Kernel Address Sanitizer) reports indicating a double-free in xe_nvm_init, with messages similar to:
- [ 13.232911] BUG: KASAN: double-free in xe_nvm_init+0x751/0xf10 [xe]
- [ 13.233112] Free of addr ... by task systemd-udevd/273
To detect this on your system, you can check the kernel logs using commands such as:
- dmesg | grep -i kasan
- journalctl -k | grep -i kasan
Additionally, enabling KASAN in your kernel configuration and running workloads that trigger the xe_nvm driver may help reproduce and detect the issue.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to update the Linux kernel to a version that includes the fix for this vulnerability.
The fix involves correcting the double-free error by moving the memory free operation into the failure path of auxiliary_device_init() and removing the erroneous error goto path.
Until the kernel is updated, you may consider disabling or unloading the xe_nvm kernel module if it is not required, to prevent triggering the vulnerable code.