CVE-2026-23350
Use-After-Free in Linux Kernel drm/xe Exec Queue Management
Publication date: 2026-03-25
Last updated on: 2026-04-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.19.1 (inc) to 6.19.7 (exc) |
| linux | linux_kernel | 6.19 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's drm/xe/queue component. It occurs because every call to initialize a queue (queue init) must be paired with a corresponding finalization call (fini). If the fini call is skipped when queue creation fails, the queue is not properly removed from the GuC list, which is involved in guc_id allocation.
As a result, a damaged queue remains stored in the exec_queue_lookup list, which can lead to invalid memory references at some point later. The fix involves ensuring that fini is called to free the guc_id before any internal LRCs are freed, preventing the invalid memory reference issue.
How can this vulnerability impact me? :
The impact of this vulnerability is that it can cause invalid memory references within the Linux kernel. This can lead to system instability, crashes, or potentially allow an attacker to exploit the kernel memory corruption for further malicious actions.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved by ensuring that every call to queue initialization has a corresponding finalization call (fini) to properly free resources and avoid invalid memory references.
Immediate mitigation steps include updating the Linux kernel to a version that includes the fix where the function _xe_exec_queue_fini() is reused and xe_lrc_put() is modified to handle NULL parameters safely.