CVE-2026-64021 Overview
CVE-2026-64021 is a memory leak vulnerability in the Linux kernel's Intel Xe graphics driver, specifically in the observation architecture (OA) subsystem. The flaw exists in the xe_oa_stream_open_ioctl() function within drm/xe/oa. When the param.exec_q->width value exceeds one, the function returns -EOPNOTSUPP directly without traversing the err_exec_q cleanup path. This bypass leaks the exec_queue reference previously obtained by xe_exec_queue_lookup(). The leaked reference pins both the exec queue and the file's private state indefinitely, preventing normal resource release even on file close.
Critical Impact
Local users can trigger persistent kernel resource leaks through repeated ioctl calls, exhausting memory and pinning graphics driver state until reboot.
Affected Products
- Linux kernel versions containing the drm/xe/oa driver prior to the fix
- Systems using Intel Xe GPU driver with observation architecture support
- Stable kernel branches referenced in the upstream commits
Discovery Timeline
- 2026-07-19 - CVE-2026-64021 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64021
Vulnerability Analysis
The vulnerability is a memory leak (reference count leak) in the Intel Xe Direct Rendering Manager (DRM) driver's observation architecture code. The xe_oa_stream_open_ioctl() function processes user-supplied parameters to open a performance monitoring stream. During parameter validation, the function checks whether param.exec_q->width > 1, a condition currently unsupported by the OA stream code path.
When this condition is true, the function returns -EOPNOTSUPP immediately using a direct return statement rather than a goto to the shared cleanup label. This skips the err_exec_q cleanup block responsible for releasing the exec queue reference. Local attackers can repeatedly invoke the ioctl with a wide exec queue to accumulate leaked references over time.
Root Cause
The root cause is improper error handling flow in xe_oa_stream_open_ioctl(). The function acquires a reference via xe_exec_queue_lookup() but exits an early validation check without releasing that reference. The exec queue holds a reference on the xe_file structure, dropped only during queue teardown. Because the leaked lookup reference is not tracked in the file's exec_queue xarray, the standard file close mechanism cannot reclaim it. This keeps both the exec queue object and the associated file private state pinned in kernel memory permanently.
Attack Vector
Exploitation requires local access with permissions to open the Xe DRM device node and issue ioctl calls. An unprivileged local user with GPU access can craft an OA stream open request specifying an exec queue with width > 1. Each failed call increments the leaked reference count without a corresponding release. Repeated invocations degrade system stability by exhausting kernel memory and preventing cleanup of graphics resources. The upstream fix replaces the direct return with a goto err_exec_q jump so the reference is properly released. See the upstream commit reference for the patch.
Detection Methods for CVE-2026-64021
Indicators of Compromise
- Growing kernel memory consumption attributable to drm/xe allocations without corresponding release
- Persistent exec queue objects remaining allocated after process termination
- Unusually high frequency of EOPNOTSUPP returns from Xe OA stream open ioctl calls in kernel traces
- File descriptors closed by user processes with lingering kernel-side private state
Detection Strategies
- Monitor /proc/slabinfo for abnormal growth in DRM-related slab caches on systems with Intel Xe GPUs
- Instrument xe_oa_stream_open_ioctl with kprobes or eBPF to record return paths and detect leak-triggering call patterns
- Correlate ioctl error return statistics with kernel memory consumption trends over time
- Audit installed kernel versions against fixed stable branches referenced in the upstream commits
Monitoring Recommendations
- Track total resident kernel memory on affected systems and alert on sustained growth without workload change
- Enable DRM driver debug logging temporarily to identify processes issuing malformed OA stream requests
- Log local user activity against /dev/dri/renderD* device nodes for anomalous ioctl volume
How to Mitigate CVE-2026-64021
Immediate Actions Required
- Apply the upstream Linux kernel patch that redirects the width > 1 failure path to the err_exec_q cleanup label
- Update to a stable kernel release incorporating commits 04ef7592eaad, 4b0c4f0c1b13, or 4d25342543c0
- Restrict access to Intel Xe DRM device nodes to trusted users where feasible until patched
- Inventory systems running kernels with the Xe driver enabled and prioritize patching
Patch Information
The fix was cherry-picked from upstream commit 339fa0be9e4a5d69fa47e91f4a36574224fb478f. Backports are available in stable kernel branches. Review the Kernel Git commit for 04ef7592, the Kernel Git commit for 4b0c4f0c, and the Kernel Git commit for 4d253425 for exact backport targets.
Workarounds
- Disable the Intel Xe kernel module on systems where GPU observation architecture is not required
- Apply Linux Security Module policies to restrict ioctl access on /dev/dri/renderD* nodes to specific service accounts
- Reduce local user access on multi-tenant hosts running affected kernels until patches are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
