CVE-2026-72360

Received Received - Intake

DRM/XE PF Relay Handling Flaw in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FAST_REQUEST nor EVENT messages as this would result in breaking the VFPF ABI protocol and also might trigger an assert on the PF side. (cherry picked from commit 1714d360fc5ae2e0886a69e979095d9c7ff3568a)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72360

EUVD

EUVD-2026-59259

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the PF (Physical Function) incorrectly handling FAST_REQ or EVENT relay messages in the VF/PF relay mechanism. The PF should only process regular REQUEST messages to maintain the VFPF ABI protocol. Attempting to handle other message types could break the protocol and trigger an assertion failure on the PF side.

Detection Guidance

This vulnerability is specific to the Linux kernel's drm/xe/pf driver and relates to improper handling of FAST_REQ or EVENT relay messages. Detection requires checking kernel logs for related errors or assertions. Use commands like dmesg | grep xe or journalctl -k | grep xe to inspect kernel logs for xe-related errors or crashes.

Impact Analysis

This vulnerability could lead to system instability or crashes if the PF incorrectly processes unsupported relay messages. It may cause unexpected behavior in systems using the Linux kernel with affected configurations, potentially disrupting operations dependent on the VFPF ABI protocol.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel driver issue (drm/xe/pf) involving relay message handling. No evidence suggests data exposure, privacy violations, or security control failures that would impact regulatory compliance.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this vulnerability. Check your distribution's security advisories for the specific kernel version addressing CVE-2026-72360.

Hi! I’m here to help you understand CVE-2026-72360. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70