CVE-2026-43396 Overview
CVE-2026-43396 is a memory leak vulnerability in the Linux kernel's drm/xe/sync subsystem. The flaw resides in the Xe Direct Rendering Manager (DRM) driver, which provides graphics acceleration for Intel GPUs. When dma_fence_chain_alloc() fails during synchronization object setup, the kernel does not release the associated user fence reference. This causes a memory leak that accumulates over repeated allocation failures.
The issue was resolved upstream and backported to stable kernel branches via commit a5d5634cde48a9fcd68c8504aa07f89f175074a0.
Critical Impact
Repeated allocation failures in the drm/xe/sync path leak user fence references, leading to kernel memory exhaustion and potential denial of service on systems using the Intel Xe graphics driver.
Affected Products
- Linux kernel versions containing the Xe DRM driver prior to the fix
- Stable kernel branches before the cherry-picked patch was applied
- Systems running Intel GPU workloads through the drm/xe driver
Discovery Timeline
- 2026-05-08 - CVE-2026-43396 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43396
Vulnerability Analysis
The vulnerability is a memory leak [CWE-401] in the Xe DRM synchronization path. The drm/xe/sync code allocates a dma_fence_chain structure to support chained fence synchronization between GPU operations. Before the allocation, the code acquires a reference to a user fence object. When dma_fence_chain_alloc() returns a failure, the original error path returns without dropping the user fence reference it had just taken.
Each failed call leaks one user fence reference and the associated kernel memory. An unprivileged local user with access to the DRM device node can repeatedly trigger the allocation path under memory pressure, causing reference counts to grow without bound and exhausting kernel memory over time.
Root Cause
The root cause is an incomplete cleanup sequence in the error handling branch of the Xe sync setup routine. The user fence reference is acquired before dma_fence_chain_alloc(), but the failure path bypasses the xe_sync_pt_put() or equivalent release call. The fix restores correct cleanup ordering so that the user fence reference is released when chain allocation fails.
Attack Vector
Local users with access to the /dev/dri/renderD* or /dev/dri/card* device nodes can exercise the affected ioctl path. By submitting repeated synchronization operations under induced memory pressure, an attacker can force dma_fence_chain_alloc() failures and gradually leak kernel memory. The vulnerability does not provide direct code execution or privilege escalation, but sustained exploitation degrades system stability.
No public proof-of-concept code is available for this issue, and the fix is described in the upstream commit referenced in the Linux kernel stable tree.
Detection Methods for CVE-2026-43396
Indicators of Compromise
- Steady, unexplained growth in kernel slab memory consumption on systems using the Intel Xe GPU driver
- Repeated DRM ioctl activity from unprivileged processes accompanied by allocation failures in dmesg
- dma_fence or xe_sync related objects accumulating in /proc/slabinfo
Detection Strategies
- Compare installed kernel build identifiers against the fixed commits listed in the kernel.org stable tree
- Audit running kernels for the presence of the Xe DRM driver and the absence of the backported fix
- Monitor /proc/meminfoSlab and SReclaimable counters for sustained upward trends on graphics-heavy hosts
Monitoring Recommendations
- Track kernel memory utilization through node-level telemetry and alert on abnormal slab growth
- Log DRM ioctl failure rates and correlate spikes with the originating user or process
- Enable kernel memory leak detection (CONFIG_DEBUG_KMEMLEAK) on test systems to validate the presence of the fix
How to Mitigate CVE-2026-43396
Immediate Actions Required
- Apply the stable kernel update that includes commit a5d5634cde48a9fcd68c8504aa07f89f175074a0 or its backports 05edc78eb469, 0879c3f04f67, and f8f90b33934b
- Reboot affected systems after kernel installation to load the patched image
- Inventory hosts using the drm/xe driver and prioritize patching graphics workstations and GPU compute nodes
Patch Information
The fix was committed to the mainline Linux kernel and cherry-picked to stable branches. Distributions should ship updated packages that incorporate the referenced commits. Refer to vendor advisories from your Linux distribution for the specific package version that contains the patch. The upstream changes are tracked at git.kernel.org commit 05edc78e, commit 0879c3f0, and commit f8f90b33.
Workarounds
- Restrict access to DRM device nodes by tightening group membership on /dev/dri/* where graphics access is not required
- Avoid loading the xe kernel module on systems that do not need Intel Xe GPU support by blacklisting it in /etc/modprobe.d/
- Apply cgroup memory limits to untrusted user sessions to contain the impact of slow kernel memory growth
# Blacklist the xe driver on systems that do not require it
echo 'blacklist xe' | sudo tee /etc/modprobe.d/blacklist-xe.conf
sudo update-initramfs -u
# Verify the running kernel version after patching
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
