CVE-2026-52951: Linux Kernel Use-After-Free Vulnerability

CVE-2026-52951 Overview

CVE-2026-52951 is a use-after-free (UAF) and race condition vulnerability in the Linux kernel's drm/xe/dma-buf subsystem. The flaw resides in the buffer object (BO) import path used by the Xe DRM driver when handling DMA-BUF attachments from exporters such as amdgpu. The attachment becomes visible on the exporter's attachment list before the buffer object is fully initialized in xe_dma_buf_init_obj(), allowing the exporter to invoke the invalidate_mappings hook against an empty or freed BO. Multiple customer reports describe NULL pointer dereferences in evict_flags when importing buffers from amdgpu and triggering eviction.

Critical Impact
A race window between DMA-BUF attachment and full buffer-object initialization can trigger NULL pointer dereferences or use-after-free conditions in the Linux kernel, leading to kernel crashes and potential memory corruption.

Affected Products

Linux kernel drm/xe driver (DMA-BUF import path)
Systems importing DMA-BUF objects from amdgpu into the Xe DRM driver
Stable kernel branches receiving the cherry-picked fix from commit af1f2ad0c59f

Discovery Timeline

2026-06-24 - CVE-2026-52951 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52951

Vulnerability Analysis

The vulnerability lies in the ordering of operations during DMA-BUF import in the Xe DRM driver. The driver calls xe_bo_alloc() and then performs dma_buf_attach() before invoking the full buffer-object setup in xe_dma_buf_init_obj(). Once attached, the BO is reachable from the exporter's attachment list, but the BO itself is not yet fully initialized.

This creates two distinct race conditions. In the first scenario, the exporter driver (for example amdgpu) invokes the invalidate_mappings callback against a partially constructed BO, dereferencing fields that have not been populated. In the second scenario, xe_bo_init_locked() fails and the BO is freed on the error path while still attached from the DMA-BUF perspective. A subsequent invalidate_mappings callback then accesses freed memory, producing a classic use-after-free.

Reported symptoms include NULL pointer dereferences in evict_flags during eviction flows triggered after a DMA-BUF import. The low hit rate observed by reporters is consistent with a narrow race window between attachment and initialization.

Root Cause

The root cause is improper ordering of dma_buf_attach() relative to buffer-object initialization. Publishing the attachment before the BO is fully constructed exposes incomplete or freed state to the exporter's invalidation callback.

Attack Vector

Exploitation requires local access capable of triggering DMA-BUF import operations between the Xe DRM driver and another graphics driver such as amdgpu, followed by an eviction event. The condition is timing-dependent and primarily manifests as a stability defect, though use-after-free in kernel memory carries the potential for memory corruption.

No public exploit code is available. Technical details are documented in the upstream commits referenced below.

Detection Methods for CVE-2026-52951

Indicators of Compromise

Kernel oops or panic referencing evict_flags in the drm/xe call stack
NULL pointer dereferences originating from invalidate_mappings callbacks during DMA-BUF eviction
Crash signatures occurring shortly after cross-driver DMA-BUF imports between amdgpu and xe

Detection Strategies

Monitor dmesg and journalctl -k output for kernel oops messages involving xe_dma_buf, evict_flags, or invalidate_mappings
Collect kernel crash dumps via kdump on systems running mixed xe and amdgpu workloads to identify the faulting instruction
Compare running kernel build against fixed commit hashes (20a99ea, 981bedb, 9894731, c473ae2) using uname -r and distribution patch metadata

Monitoring Recommendations

Track kernel version inventory across endpoints to identify hosts running unpatched drm/xe code
Alert on repeated kernel crashes from graphics workloads, particularly those involving DMA-BUF or GPU eviction paths
Forward kernel logs to a centralized data lake for correlation across hosts that share hardware profiles

How to Mitigate CVE-2026-52951

Immediate Actions Required

Update affected Linux kernels to a stable release containing the upstream fix cherry-picked from commit af1f2ad0c59fe4e2f924c526f66e968289d77971
Apply distribution kernel updates that include any of the merged fix commits: 20a99ea1, 981bedbb, 9894731e, or c473ae25
Validate that hosts using the Xe DRM driver alongside amdgpu have rebooted into the patched kernel

Patch Information

The fix moves the dma_buf_attach() call until after the buffer object is fully initialized, ensuring the exporter cannot invoke invalidate_mappings against an incomplete or freed BO. Patch commits are published at Kernel Git Commit 20a99ea, Kernel Git Commit 981bedb, Kernel Git Commit 9894731, and Kernel Git Commit c473ae2.

Workarounds

Avoid mixed-driver DMA-BUF imports between amdgpu and xe on unpatched kernels where workloads permit
Restrict workloads that perform cross-driver buffer sharing to systems running patched kernels only
If kernel updates cannot be applied immediately, unload the xe module on hosts that do not require it: modprobe -r xe

bash

# Verify the running kernel includes the fix
uname -r
zcat /proc/config.gz | grep CONFIG_DRM_XE
# Check distribution changelog for the fix commit references
rpm -q --changelog kernel | grep -E 'af1f2ad0|xe.*dma-buf'