CVE-2026-53290: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53290 Overview

CVE-2026-53290 is a use-after-free vulnerability in the Linux kernel's Intel Xe Direct Rendering Manager (DRM) driver, specifically in the EU stall sampling subsystem. The flaw exists in xe_eu_stall_stream_close(), where drm_dev_put() is invoked before the stream is disabled and its resources are freed. If the drm_dev_put() call drops the final reference, subsequent cleanup code continues to access already-freed device structures. A local authenticated attacker with access to the Xe DRM interface can trigger this condition to corrupt kernel memory. The upstream fix reorders the operations to match the pattern used in xe_oa_release(), moving drm_dev_put() after all device accesses complete.

Critical Impact
Local exploitation can lead to kernel memory corruption, enabling privilege escalation or denial of service on systems using Intel Xe graphics with EU stall sampling.

Affected Products

Linux kernel builds including the drm/xe driver with EU stall sampling support
Systems running Intel Xe-based graphics hardware exposing the eustall interface
Distributions shipping kernel versions prior to the fix commits 84f2bfbe6e38, bebce43f34b5, and dc2d9842c67d

Discovery Timeline

2026-06-26 - CVE-2026-53290 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53290

Vulnerability Analysis

The vulnerability resides in the Xe DRM driver's EU stall sampling close path. xe_eu_stall_stream_close() is invoked when userspace closes the stall sampling file descriptor. In the flawed implementation, the function releases its reference on the DRM device via drm_dev_put() before executing the remainder of the cleanup logic, which still dereferences device-scoped structures such as the stream context and hardware register mappings.

When the reference dropped by drm_dev_put() is the last one held, the DRM core proceeds to free the underlying struct drm_device and its embedded state. Any subsequent access from the close handler then operates on freed memory. This condition constitutes a classic use-after-free [CWE-416] in kernel context, where the attacker controls the timing of the final reference release through concurrent handle operations.

Root Cause

The root cause is incorrect ordering of resource release operations. The close handler released the parent object reference before finishing operations on child structures owned by that parent. The fix relocates the drm_dev_put() call to occur only after stream disable and resource teardown complete, mirroring the established ordering in xe_oa_release().

Attack Vector

Exploitation requires local access with permissions to open the Xe EU stall sampling interface. An attacker orchestrates concurrent open and close operations on the stall stream file descriptor to arrange the reference count so that drm_dev_put() in the vulnerable close path drops the final reference. The freed kernel allocation can then be reclaimed with attacker-controlled data before the residual cleanup code dereferences the stale pointer, yielding write primitives against kernel memory.

No verified public proof-of-concept code is available. See the upstream fix commit for the exact code path.

Detection Methods for CVE-2026-53290

Indicators of Compromise

Unexpected kernel oops or panic messages referencing xe_eu_stall_stream_close, drm_dev_put, or slab use-after-free reports from KASAN
dmesg entries showing DRM device refcount underflow warnings on systems with Intel Xe hardware
Unprivileged processes repeatedly opening and closing /dev/dri/renderD* handles targeting the eustall ioctl interface

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test environments to surface the use-after-free on the Xe close path
Audit kernel package versions across the fleet and flag hosts running kernels predating the fix commits 84f2bfbe6e38, bebce43f34b5, and dc2d9842c67d
Correlate DRM ioctl activity with subsequent kernel crash telemetry to identify targeted exploitation attempts

Monitoring Recommendations

Ship kernel ring buffer and kdump crash artifacts to a central logging platform for signature-based review
Alert on non-graphics workloads issuing Xe DRM ioctls, particularly EU stall sampling calls from unexpected user contexts
Track process lineage for repeated short-lived opens of Xe render nodes, which can indicate refcount racing attempts

How to Mitigate CVE-2026-53290

Immediate Actions Required

Apply vendor kernel updates that incorporate the upstream fix reordering drm_dev_put() after stream teardown
Inventory hosts using Intel Xe graphics and prioritize patching multi-user systems where local access is broadly available
Restrict access to /dev/dri/renderD* nodes to trusted users and service accounts via group membership and udev rules

Patch Information

The fix is available in stable kernel trees via the following commits: 84f2bfbe6e38, bebce43f34b5, and dc2d9842c67d. The change moves drm_dev_put() to execute after all device accesses complete, cherry-picked from upstream commit 35aff528f7297e949e5e19c9cd7fd748cf1cf21c. Consult the distribution security tracker to identify the specific kernel package version delivering the fix.

Workarounds

Disable or blacklist the xe kernel module on systems that do not require Intel Xe graphics acceleration
Tighten permissions on DRM render nodes so that only vetted local accounts can open the eustall interface
Where feasible, disable EU stall sampling functionality in the kernel build configuration until a patched kernel is deployed

bash

# Restrict DRM render node access to a trusted group
sudo groupadd -r drm-trusted
sudo usermod -aG drm-trusted <trusted-user>
echo 'SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="drm-trusted", MODE="0660"' | \
  sudo tee /etc/udev/rules.d/60-drm-restrict.rules
sudo udevadm control --reload && sudo udevadm trigger

# Optionally blacklist the xe driver where not required
echo 'blacklist xe' | sudo tee /etc/modprobe.d/blacklist-xe.conf