SB20261023160 - Use-after-free in Linux kernel drm xe driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-98999)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel's Xe DRM buffer-object pin management when a framebuffer unpin performs the final unpin without removing the object's pinned_link list entry. A local user can trigger overlapping external and framebuffer pin operations, with the external unpin occurring first, to leave a stale list entry after the buffer object is freed and potentially cause a kernel crash when the list is subsequently walked or spliced.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3a11adcfd9a2de74d405bd3e8c4d7a1b328e4684
• https://git.kernel.org/stable/c/b3eaff982839e5c22912d604cd8e7748cece8d63
• https://git.kernel.org/stable/c/cf238c067eaae1cbfb00738e29219b9568d2313e