CVE-2026-53142: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53142 Overview

CVE-2026-53142 is a null pointer dereference vulnerability in the Linux kernel's drm/xe graphics driver. The flaw occurs in the display suspend and shutdown paths on systems where display hardware is disabled via fuses. The xe driver tracks display probing through xe->info.probe_display, but this flag is not updated when display is disabled later in intel_display_device_info_runtime_init(). As a result, xe_display_flush_cleanup_work() iterates over uninitialized mode configuration via for_each_intel_crtc(), triggering a kernel oops. The issue was introduced by commit 44e694958b95 and surfaced more prominently with commit ddf6492e0e50.

Critical Impact
Systems running affected Linux kernels with Intel Xe graphics and fuse-disabled display hardware can experience kernel oops during suspend or shutdown, resulting in denial of service.

Affected Products

Linux kernel versions containing the drm/xe display driver introduced by commit 44e694958b95
Linux kernel versions including commit ddf6492e0e50 ("drm/xe/display: Make display suspend/resume work on discrete")
Systems using Intel Xe GPUs where display hardware is disabled via fuses

Discovery Timeline

2026-06-25 - CVE-2026-53142 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53142

Vulnerability Analysis

The xe driver maintains display state in xe->info.probe_display. This field is initially set based on intel_display_device_probe(). However, display hardware may be disabled later through fuse detection in intel_display_device_info_runtime_init(). The driver does not reconcile probe_display after this runtime initialization step.

During suspend or shutdown, xe_display_flush_cleanup_work() calls for_each_intel_crtc() based on the stale probe_display value. The mode configuration structure has not been initialized because no display hardware is present. Dereferencing pointers within this uninitialized structure produces a kernel oops.

The patch checks intel_display_device_present() after intel_display_device_info_runtime_init() and resets xe->info.probe_display accordingly. It also calls unset_display_features() for completeness and moves the runtime init call earlier in the probe sequence, matching the i915 driver pattern.

Root Cause

The root cause is inconsistent state tracking between two display detection phases. The xe driver checks display presence at probe time but does not re-evaluate after fuse-based runtime detection disables the display. Low-level display plumbing such as for_each_intel_crtc() in xe_display_flush_cleanup_work() then operates on uninitialized data structures.

Attack Vector

This vulnerability is not remotely exploitable. It triggers automatically on affected hardware during suspend or shutdown operations. A local user invoking system suspend or shutdown on a vulnerable configuration would trigger the oops. No specific exploitation code is required as the condition is reached through normal system operation.

No verified exploit code is publicly available. The references point to Linux kernel commits resolving the issue.

Detection Methods for CVE-2026-53142

Indicators of Compromise

Kernel oops messages referencing xe_display_flush_cleanup_work or for_each_intel_crtc in dmesg or journalctl output
NULL pointer dereference stack traces originating from the drm/xe driver during suspend or shutdown
Unexpected kernel panics or system freezes when initiating suspend on systems with Intel Xe GPUs and fuse-disabled display

Detection Strategies

Inventory hosts running kernel versions that include commits 44e694958b95 and ddf6492e0e50 but lack the fix commits 0f68ddf, 238bcd, or 68938c
Correlate hardware inventory data for Intel Xe GPU presence with kernel module loads of xe
Parse system crash dumps for stack frames containing xe_display_flush_cleanup_work and uninitialized mode_config access

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on BUG: or Oops: entries from the drm/xe subsystem
Track suspend and shutdown failure events through systemd-suspend.service exit codes
Monitor for repeated reboots correlated with display driver stack traces

How to Mitigate CVE-2026-53142

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 0f68ddfaaebfbb5581ee931779757d31f4dc9e24, 238bcdaae8f2abc65e182de7d1f69cf8f611a610, and 68938cc08e23a94fd881e845837ff918de005ce7
Update to a stable kernel release that includes the cherry-picked fix from commit 7c3eb9f47533220888a67266448185fd0775d4da
Identify systems using Intel Xe GPUs with fuse-disabled display hardware as priority remediation targets

Patch Information

The fix is available in upstream Linux kernel stable trees. Refer to Linux Kernel Commit 0f68ddf, Linux Kernel Commit 238bcd, and Linux Kernel Commit 68938c for the patched source. The fix checks intel_display_device_present() after runtime initialization and resets xe->info.probe_display when display hardware is absent.

Workarounds

Avoid using system suspend on affected hardware until the kernel is patched
Where possible, blacklist the xe module on systems with fuse-disabled Intel display hardware and use alternative graphics drivers
Consult your Linux distribution vendor for backported kernel packages addressing this issue

bash

# Verify running kernel version and check for fix presence
uname -r
dmesg | grep -i "xe_display_flush_cleanup_work"
# Blacklist xe driver as a temporary workaround if appropriate
echo "blacklist xe" | sudo tee /etc/modprobe.d/blacklist-xe.conf
sudo update-initramfs -u