CVE-2026-46264
Use-after-free in Linux kernel DRM/XE PF sysfs initialization
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's drm/xe/pf component related to sysfs initialization. When the function devm_add_action_or_reset() fails, it immediately runs a cleanup action on a kobject that has not yet been initialized. This improper handling can cause errors such as calling kobject_put() on an uninitialized kobject and refcount underflow, leading to use-after-free conditions.
The root cause is that the cleanup action is registered before the kobject is properly initialized, and in some cases, the parent kobject was incorrectly passed during cleanup registration, causing undetected resource leaks. The fix involves initializing and adding the kobject separately before registering the cleanup action, ensuring proper lifecycle management.
How can this vulnerability impact me? :
This vulnerability can lead to kernel errors such as use-after-free and refcount underflow, which may cause system instability or crashes. Improper handling of kernel objects can result in resource leaks and unpredictable behavior in the affected Linux kernel component.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for specific error messages related to uninitialized kobjects and refcount underflows.
- Look for log entries containing messages like "kobject: '(null)': is not initialized, yet kobject_put() is being called."
- Check for warnings such as "refcount_t: underflow; use-after-free."
- Use the command `dmesg | grep -E 'kobject_put|refcount_warn_saturate'` to filter relevant kernel warnings.
- Monitor system logs (e.g., /var/log/kern.log or /var/log/messages) for similar warning patterns.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed by properly initializing kobjects before registering cleanup actions.
Immediate mitigation involves updating the Linux kernel to a version that includes the fix for this issue.
- Apply the patch that calls kobject_init() and kobject_add() separately and registers cleanup actions only after initialization.
- Avoid running vulnerable kernel versions that may trigger use-after-free errors in the drm/xe/pf subsystem.