CVE-2026-80903
Received Received - Intake

Memory Leak in Linux Kernel DRM/XE OA

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry leak on OA config emit failure xe_oa_emit_oa_config() releases the sync entries and the syncs array only on its success path. When it fails before the point of no return (fence allocation, config buffer allocation or batch submission), it returns without touching stream->syncs. The stream open path handles such failures in the caller, but xe_oa_config_locked() propagates the error without any cleanup, so the syncs array and the fence references held by the parsed entries are leaked. The next config ioctl overwrites stream->syncs, making the memory unreachable for good. Clean up the parsed syncs when xe_oa_emit_oa_config() fails, matching the cleanup done by the stream open error path. (cherry picked from commit 8af97b3da2cfce04e6b457c6eb17ed3c1daf912b)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80903
EUVD
EUVD-2026-71662

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a function called xe_oa_emit_oa_config() fails to properly clean up memory when it encounters an error during configuration. Specifically, it leaks sync entries and a syncs array when failing before critical steps like fence allocation or batch submission. This leads to unreachable memory that persists until overwritten by a subsequent operation.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/XE subsystem and does not have a direct network detection method. Detection requires checking kernel logs for errors related to OA config emission failures in the xe driver. Use commands like dmesg | grep xe_oa or journalctl -k | grep xe_oa to identify such failures.

Impact Analysis

This vulnerability could lead to memory leaks in the Linux kernel, potentially causing system instability or performance degradation over time. It may also result in resource exhaustion if exploited repeatedly, though it does not directly enable data breaches or privilege escalation.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch this vulnerability. If immediate patching is not possible, monitor for OA config failures using kernel logs and avoid running graphics-intensive workloads that may trigger the issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80903. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart