CVE-2026-23162: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23162 Overview

CVE-2026-23162 is a double-free vulnerability [CWE-415] in the Linux kernel's drm/xe/nvm driver. The flaw resides in the xe_nvm_init() function, where the auxiliary device initialization error path frees memory that the .release callback later frees again. KASAN detects this condition as a double-free on the nvm allocation.

The vulnerability affects Linux kernel versions 6.17 and 6.19 release candidates running on systems with the Intel Xe graphics driver. Local attackers with the ability to trigger the driver initialization path can corrupt kernel memory.

Critical Impact
Local exploitation can lead to kernel memory corruption, privilege escalation, or denial of service on affected systems running the xe graphics driver.

Affected Products

Linux kernel 6.17 (including 6.17-rc7)
Linux kernel 6.19-rc1 through 6.19-rc7
Systems using the Intel Xe DRM driver with NVM auxiliary device support

Discovery Timeline

2026-02-14 - CVE-2026-23162 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23162

Vulnerability Analysis

The vulnerability stems from incorrect cleanup logic in the Intel Xe NVM (Non-Volatile Memory) driver. After a successful call to auxiliary_device_init(), the kernel sets aux_dev->dev.release to xe_nvm_release_dev(), which is responsible for invoking kfree(nvm).

When auxiliary_device_add() subsequently fails, the driver calls auxiliary_device_uninit(). This function calls put_device(), which triggers the .release callback and frees the nvm allocation. The original error path then incorrectly calls kfree(nvm) again through a goto cleanup label, resulting in a double-free.

KASAN flags the condition with the message BUG: KASAN: double-free in xe_nvm_init. The fix moves kfree(nvm) exclusively into the auxiliary_device_init() failure path and removes the erroneous err goto cleanup, ensuring the allocation is freed only once.

Root Cause

The root cause is a lifecycle management error in auxiliary device cleanup. The driver did not account for the ownership transfer that occurs after auxiliary_device_init() succeeds. Once the release callback is registered, the caller no longer owns the allocation and must not free it directly.

Attack Vector

Exploitation requires local access with low privileges to trigger the vulnerable code path during xe driver initialization. An attacker who can induce auxiliary_device_add() failure (for example, through resource exhaustion or device manipulation) can force the double-free. Successful exploitation of double-free conditions in the kernel can result in heap corruption and arbitrary code execution at ring 0.

The vulnerability mechanism is described in the upstream commit messages. See the kernel git commits at Kernel Git Commit 32887d8 and Kernel Git Commit 8a44241 for the patch implementation.

Detection Methods for CVE-2026-23162

Indicators of Compromise

KASAN log entries containing BUG: KASAN: double-free in xe_nvm_init
Kernel oops or panic referencing xe_nvm_release_dev or auxiliary_device_uninit
Unexpected xe driver load failures on systems with Intel Xe graphics hardware
Slab allocator corruption messages following auxiliary device probe failures

Detection Strategies

Enable KASAN (CONFIG_KASAN=y) on test and development kernels to catch double-free conditions at runtime
Audit installed kernel versions against the affected 6.17 and 6.19-rc ranges using package inventory tools
Monitor dmesg output for xe module initialization errors and KASAN reports
Review kernel crash dumps for stack traces involving xe_nvm_init and kfree calls

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on KASAN signatures referencing xe_nvm
Track unexpected reboots or kernel panics on workstations equipped with Intel Xe GPUs
Monitor for unauthorized kernel module loads of the xe driver in environments where it should not be active
Correlate driver crash events with subsequent privilege escalation attempts on the same host

How to Mitigate CVE-2026-23162

Immediate Actions Required

Apply the upstream kernel patches referenced in commits 32887d8e4bc0 and 8a44241b0b83 as soon as distribution builds are available
Inventory all systems running Linux kernel 6.17 or 6.19 release candidates with Intel Xe graphics hardware
Restrict local access on affected systems until patches are deployed, since the attack vector requires local privileges
Test patched kernels in staging environments before rolling out to production endpoints

Patch Information

The fix is available in the mainline Linux kernel tree. The patch moves kfree(nvm) into the auxiliary_device_init() failure path and removes the redundant err goto cleanup path. Reference the patches at Kernel Git Commit 32887d8 and Kernel Git Commit 8a44241. Distribution-specific backports should be tracked through the respective vendor security advisories.

Workarounds

Blacklist the xe kernel module on affected systems that do not require Intel Xe graphics support
Disable the auxiliary NVM device functionality at boot via kernel command-line parameters where supported
Downgrade to a kernel version that predates the introduction of the vulnerable xe_nvm_init code path if patching is not immediately feasible
Limit shell access and constrain local user permissions to reduce the local attack surface

bash

# Blacklist the xe driver until a patched kernel is deployed
echo "blacklist xe" | sudo tee /etc/modprobe.d/blacklist-xe.conf
sudo update-initramfs -u
sudo reboot