CVE-2026-46224
Memory Leak in Linux Kernel DRM/XE Driver
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a memory leak in the Linux kernel's drm/xe component. Specifically, when the function drm_gpuvm_resv_object_alloc() fails during allocation, a pre-allocated buffer object (bo) is not freed properly, causing a resource leak.
The issue arises because xe_dma_buf_init_obj() calls xe_bo_init_locked(), which frees the bo on error, but xe_dma_buf_init_obj() itself does not free the bo on its own error paths. This leads to ambiguity in xe_gem_prime_import() about whether the bo should be freed, resulting in the leak.
The fix involves adding explicit freeing of the bo (using xe_bo_free(storage)) before returning an error, and adding comments to clarify ownership semantics of the storage object.
How can this vulnerability impact me? :
This vulnerability can lead to a memory leak in the Linux kernel's graphics subsystem. Over time, repeated allocation failures without proper freeing of resources could cause increased memory usage, potentially degrading system performance or leading to resource exhaustion.
Such leaks might affect system stability, especially in environments with heavy graphics workloads or constrained memory resources.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed in the Linux kernel by ensuring that the buffer object (bo) is properly freed on allocation failure in the drm/xe driver. To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix described in the commit 78a6c5f899f22338bbf48b44fb8950409c5a69b9.
No other immediate mitigation steps or workarounds are provided.