CVE-2026-52976: Linux Kernel Use-After-Free Vulnerability

CVE-2026-52976 Overview

CVE-2026-52976 is a Linux kernel vulnerability in the Intel Xe Direct Rendering Manager (DRM) driver. The flaw resides in the xe_exec_queue_create_ioctl() function, where two distinct error handling paths fail to properly clean up resources. Both issues can result in dangling pointers or use-after-free conditions when execution queue creation fails after partial initialization. The kernel community resolved the issue by restructuring the error cleanup flow to ensure queues are removed from VM compute lists and hardware engine group lists before being freed.

Critical Impact
Local attackers triggering specific ioctl error paths can induce use-after-free conditions in the kernel, potentially leading to memory corruption or privilege escalation on systems using the Intel Xe graphics driver.

Affected Products

Linux kernel versions containing the drm/xe driver prior to the fix commit 37c831f401746a45d510b312b0ed7a77b1e06ec8
Distributions shipping the Intel Xe DRM driver for Intel GPUs
Stable kernel branches receiving the backported patches referenced in the advisory

Discovery Timeline

2026-06-24 - CVE-2026-52976 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52976

Vulnerability Analysis

The vulnerability exists in the xe_exec_queue_create_ioctl() function within the Intel Xe DRM driver. This ioctl handler creates an execution queue for GPU work submission and registers it with both the virtual machine context and the hardware engine group. Two error paths in the original implementation skip required cleanup steps.

The first issue occurs when xe_hw_engine_group_add_exec_queue() fails. The error path jumps to the put_exec_queue label, bypassing xe_exec_queue_kill(). If the VM operates in preempt fence mode, xe_vm_add_compute_exec_queue() has already inserted the queue onto the VM's compute exec queue list. The queue is then freed while still linked, producing a dangling pointer.

The second issue arises when xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has succeeded. The cleanup path omits the call to xe_hw_engine_group_del_exec_queue(), leaving the queue linked into the hardware engine group as it is freed. This is a classic use-after-free condition.

Root Cause

The root cause is improper ordering and incomplete unwinding in error handling labels. The original code structured cleanup labels without accounting for partial state registration across multiple subsystems. Each successful registration step adds the queue to a separate linked structure, but the error labels did not remove the queue from every list it had been added to.

Attack Vector

An attacker with local access and the ability to invoke DRM ioctls on the Xe driver can trigger the vulnerable error paths by crafting an xe_exec_queue_create ioctl call designed to fail at one of the two specific points. Forcing xa_alloc() failure, for example through resource exhaustion or specific identifier collision, can produce the use-after-free state on a queue still referenced by the hardware engine group list.

No verified public exploit code is available. The vulnerability mechanism is documented in the upstream patch commits referenced in this advisory. See the Kernel Patch f3cc22d4 for the corrective changes.

Detection Methods for CVE-2026-52976

Indicators of Compromise

Kernel oops, panic, or KASAN reports referencing xe_exec_queue, xe_hw_engine_group, or xe_vm_add_compute_exec_queue in the call trace
Unexpected GPU driver crashes or system instability following DRM ioctl activity from unprivileged processes
Audit log entries showing repeated failed DRM_IOCTL_XE_EXEC_QUEUE_CREATE invocations from a single user process

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test systems to catch use-after-free accesses in the Xe driver during fuzzing or production validation
Monitor kernel ring buffer messages for stack traces involving the Xe DRM subsystem and exec queue functions
Use eBPF tracing to record xe_exec_queue_create_ioctl entry, error returns, and subsequent queue list operations

Monitoring Recommendations

Track kernel versions across the fleet and flag hosts running unpatched drm/xe driver builds
Alert on high-frequency DRM ioctl failures correlated with non-graphics workloads, which may indicate exploitation probing
Forward kernel crash dumps and oops reports to a central log store for retrospective analysis

How to Mitigate CVE-2026-52976

Immediate Actions Required

Apply the upstream stable kernel patches listed in the advisory references and rebuild affected kernels
Identify all systems running Intel GPUs with the Xe driver loaded and prioritize patching for multi-user or shared-tenant hosts
Restrict access to DRM device nodes (/dev/dri/*) to trusted users and groups where the patch cannot be applied immediately

Patch Information

The fix is contained in upstream commit 37c831f401746a45d510b312b0ed7a77b1e06ec8 and backported through the stable tree. Apply one of the following stable patches as appropriate for your kernel branch: Kernel Patch 1be55646, Kernel Patch 753b149d, Kernel Patch f3cc22d4, or Kernel Patch f93b0016. The fix reroutes the xe_hw_engine_group_add_exec_queue() failure to kill_exec_queue and adds a del_hw_engine_group label so the queue is removed from all lists before being freed.

Workarounds

Unload the Xe driver (modprobe -r xe) on systems that do not require Intel Xe GPU functionality
Tighten permissions on /dev/dri/renderD* and /dev/dri/card* to limit which local users can invoke the vulnerable ioctl
Disable user namespaces or container access to DRM devices where graphics acceleration is not required

bash

# Restrict DRM device access to the video group and remove world access
sudo chgrp video /dev/dri/renderD*
sudo chmod 0660 /dev/dri/renderD*

# Optionally blacklist the xe driver on hosts that do not need Intel Xe GPU support
echo "blacklist xe" | sudo tee /etc/modprobe.d/blacklist-xe.conf
sudo update-initramfs -u