SB20260625232 - Use-after-free in Linux kernel drm xe driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-52951)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in the xe dma-buf import handling in drivers/gpu/drm/xe/xe_dma_buf.c when triggering the invalidate_mappings hook during buffer object initialization or error handling. A local user can trigger dma-buf import and race the invalidate_mappings callback to cause a denial of service.

The issue can occur when importing a dma-buf from another driver such as amdgpu, and reported outcomes include NULL pointer dereference and crashes during eviction flow.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/20a99ea1e2fd720856d6ba497ff26b82c604751f
• https://git.kernel.org/stable/c/981bedbbe61364fcc3a3b87ebaf648a66cd07108
• https://git.kernel.org/stable/c/9894731e513019df22a29e5c52f1c98890355ff1
• https://git.kernel.org/stable/c/c473ae25421fddc3dde247ba7b85225b10641d09