CVE-2026-43395 Overview
CVE-2026-43395 is a memory leak vulnerability in the Linux kernel's Intel Xe Direct Rendering Manager (DRM) graphics driver. The flaw resides in the xe_sync_entry_parse() function within the drm/xe/sync subsystem. The function can allocate synchronization references including syncobj, fences, chain fences, or user fences before encountering a later failure path. Several error paths return directly without cleaning up these partially initialized references, leaking kernel object references. The issue has been resolved by routing error paths through a common free_sync label that calls xe_sync_entry_cleanup(sync) before returning.
Critical Impact
Repeated triggering of the failure path can exhaust kernel resources by leaking synchronization object references, potentially leading to denial of service on affected systems.
Affected Products
- Linux kernel versions containing the Intel Xe DRM driver drm/xe/sync component
- Systems running Intel Xe graphics hardware with the affected kernel driver
- Stable kernel branches prior to the fix commits referenced in the patch series
Discovery Timeline
- 2026-05-08 - CVE-2026-43395 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43395
Vulnerability Analysis
The vulnerability exists in the xe_sync_entry_parse() function of the Intel Xe DRM driver. This function parses synchronization entries supplied by userspace when submitting GPU work. During parsing, the function allocates kernel references for various synchronization primitives including DRM syncobj handles, dma-fences, chain fences, and user fences.
The defect occurs when the function encounters a failure condition after one or more references have already been acquired. Several of these error paths used direct return statements rather than jumping to a cleanup label. As a result, the partially initialized sync structure retained allocated references that were never released, causing reference count leaks on the affected kernel objects.
Root Cause
The root cause is improper error path handling, a memory leak [CWE-401] caused by missing cleanup logic. The function acquired ownership of kernel reference-counted objects but failed to release them on every error return. The fix consolidates error handling by routing all failure paths through a common free_sync label that invokes xe_sync_entry_cleanup(sync) to release any partially initialized state before returning the error code.
Attack Vector
The attack vector requires local access to a system with the Intel Xe GPU driver loaded. A local user with permission to issue GPU submissions through the DRM ioctl interface can repeatedly trigger the parse failure condition. Each failed call leaks kernel references for syncobjs, fences, chain fences, or user fences. Over time, this resource exhaustion can degrade system stability or cause denial of service. The vulnerability does not provide direct code execution or privilege escalation.
The vulnerability manifests in the synchronization entry parsing logic of the Intel Xe driver. Refer to the upstream commits at 1bfd7575, 91c228f9, af65cd18, and f0af63ff in the Linux kernel stable tree for the complete fix implementation.
Detection Methods for CVE-2026-43395
Indicators of Compromise
- Gradual increase in kernel memory usage attributable to DRM syncobj or dma-fence allocations without corresponding releases
- Elevated reference counts on synchronization objects visible through /sys/kernel/debug/dri/ interfaces
- Repeated EINVAL or similar error returns from Xe DRM ioctl submissions in kernel logs
Detection Strategies
- Audit kernel version strings against the patched commit hashes published in the kernel stable tree
- Monitor for processes making high volumes of failed DRM ioctl calls targeting the Xe driver
- Track kernel slab allocator statistics for unexpected growth in fence and syncobj caches
Monitoring Recommendations
- Collect kernel logs centrally and alert on repeated DRM submission failures from non-privileged processes
- Baseline normal GPU workload patterns and flag deviations consistent with abuse of the parse failure path
- Use process accounting to identify users issuing abnormally high rates of DRM ioctl operations
How to Mitigate CVE-2026-43395
Immediate Actions Required
- Update to a Linux kernel version that includes the upstream fix commits referenced in the kernel stable tree
- Identify hosts running Intel Xe graphics hardware with the affected driver loaded and prioritize them for patching
- Restrict local user access on multi-tenant systems where the Xe DRM device nodes are exposed
Patch Information
The fix was committed upstream and backported to stable branches. Apply the kernel update containing commit f939bdd9207a5d1fc55cced5459858480686ce22 or any of the backport commits: 1bfd7575092420ba5a0b944953c95b74a5646ff8, 91c228f96fcfacc2341a58815b1da8c69da94ebb, af65cd1853599394b94201c08bed7a46717db478, and f0af63ffa06306f12592cd3919fad6957b425e1b.
Workarounds
- Where the Intel Xe driver is not required, unload the xe kernel module to remove the attack surface
- Apply strict permissions on /dev/dri/* device nodes to limit which users can issue DRM submissions
- Use namespace and cgroup isolation to confine workloads that interact with the GPU on shared hosts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
