CVE-2026-23350 Overview
CVE-2026-23350 is a memory leak vulnerability [CWE-401] in the Linux kernel's drm/xe graphics driver. The flaw resides in the exec queue creation path, where a failed initialization does not trigger the corresponding fini call. This skips removal of the queue from the GuC list, which is part of guc_id allocation. A damaged queue stored in the exec_queue_lookup list can lead to invalid memory references during subsequent operations.
The vulnerability affects Linux kernel version 6.19 and 7.0 release candidates rc1 through rc7.
Critical Impact
A local authenticated user can trigger invalid memory references through the drm/xe queue subsystem, potentially leading to kernel memory corruption, denial of service, or local privilege escalation.
Affected Products
- Linux kernel 6.19
- Linux kernel 7.0-rc1 through 7.0-rc7
- Systems using the Intel Xe DRM graphics driver (drm/xe)
Discovery Timeline
- 2026-03-25 - CVE-2026-23350 published to NVD
- 2026-04-24 - Last updated in NVD database
Technical Details for CVE-2026-23350
Vulnerability Analysis
The vulnerability exists in the Intel Xe Direct Rendering Manager (DRM) driver within the Linux kernel. When an exec queue creation operation fails, the kernel previously skipped the corresponding fini call that releases driver resources. This left the queue partially initialized but still tracked by kernel data structures.
The guc_id allocation tied to the GuC (Graphics microController) list remained unreleased on the failure path. The damaged queue object persisted in the exec_queue_lookup list, creating a dangling reference. Subsequent lookups against this list can dereference freed or inconsistent memory.
The upstream fix refactors the failure path to reuse __xe_exec_queue_fini(), ensuring symmetric init/fini semantics. The patch also modifies xe_lrc_put() to tolerate NULL parameters, aligning it with other reference-counting helpers in the driver.
Root Cause
The root cause is an asymmetric resource lifecycle in the drm/xe exec queue creation routine. Every call to queue init must have a corresponding fini call to free the guc_id and remove the queue from internal tracking structures. The missing cleanup violates this invariant and leaves stale state visible to other kernel paths.
Attack Vector
Exploitation requires local access with the ability to invoke drm/xe ioctl interfaces, typically available to users with access to /dev/dri/* device nodes. A local attacker can repeatedly trigger exec queue creation failures to leak guc_id allocations and accumulate damaged entries in the exec_queue_lookup list. Subsequent operations against the corrupted list can result in invalid memory reads or writes within kernel context.
The vulnerability is described in prose only; no public proof-of-concept code is available. Refer to the upstream commits at Kernel Git Commit fae65b8a and Kernel Git Commit 99f9b534 for the technical fix details.
Detection Methods for CVE-2026-23350
Indicators of Compromise
- Kernel oops or warning messages referencing xe_exec_queue, xe_lrc_put, or guc_id in dmesg and /var/log/kern.log
- Repeated DRM_IOCTL_XE_EXEC_QUEUE_CREATE failures from unprivileged user processes
- Unexpected slab allocation growth tied to the Xe driver in /proc/slabinfo
Detection Strategies
- Monitor kernel logs for stack traces involving drm/xe queue functions and invalid memory access reports
- Audit process behavior for non-graphics workloads issuing high volumes of DRM ioctls against /dev/dri/renderD* nodes
- Correlate kernel panics on Intel Xe-equipped hosts with the running kernel version to identify exposure to 6.19 or 7.0-rc builds
Monitoring Recommendations
- Enable kernel address sanitizer (KASAN) builds in test environments to surface use-after-free and invalid reference patterns
- Forward kernel telemetry and audit logs to a centralized SIEM for retention and correlation
- Track installed kernel versions across the fleet against vendor advisories for the Xe driver
How to Mitigate CVE-2026-23350
Immediate Actions Required
- Identify all hosts running Linux kernel 6.19 or any 7.0 release candidate with the xe driver loaded
- Apply the upstream stable patch or update to a kernel release that includes the fix
- Restrict access to /dev/dri/* device nodes to trusted users where the Xe driver cannot be promptly patched
Patch Information
The fix is committed upstream and backported to stable trees. The relevant commits are available at Kernel Git Commit fae65b8a and Kernel Git Commit 99f9b534. The patch reuses __xe_exec_queue_fini() on the failure path and makes xe_lrc_put() NULL-safe. Administrators should rebuild or update to a kernel containing these commits.
Workarounds
- Unload the xe module with modprobe -r xe on systems that do not require Intel Xe graphics acceleration
- Blacklist the xe driver in /etc/modprobe.d/ to prevent automatic loading
- Tighten permissions on /dev/dri/renderD* so only privileged service accounts can access the Xe ioctl interface
# Disable the xe driver until a patched kernel is deployed
echo "blacklist xe" | sudo tee /etc/modprobe.d/disable-xe.conf
sudo update-initramfs -u
sudo reboot
# Verify the module is not loaded after reboot
lsmod | grep -i ^xe
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
