CVE-2026-74699 Overview
CVE-2026-74699 is a memory leak vulnerability in the Linux kernel's drm/xe graphics driver. The flaw resides in the exec_queue_set_hang_replay_state() function, where the q->replay_state field is blindly overwritten. This overwrite discards memory previously allocated by vmemdup_user() without freeing it, leaking kernel memory on each invocation.
Intel Product Security confirmed the issue, which was discovered using AI-assisted static analysis. The upstream fix returns an error when q->replay_state is not empty, preventing the leak.
Critical Impact
Repeated calls to the affected ioctl path can exhaust kernel memory, degrading system stability and enabling local denial-of-service conditions on systems using the Intel Xe DRM driver.
Affected Products
- Linux kernel builds that include the drm/xe driver prior to the fix
- Systems using Intel graphics hardware supported by the Xe DRM driver
- Distributions shipping affected mainline and stable kernel branches
Discovery Timeline
- 2026-08-22 - CVE-2026-74699 published to NVD
- 2026-08-22 - Last updated in NVD database
Technical Details for CVE-2026-74699
Vulnerability Analysis
The drm/xe driver exposes an execution queue interface that allows userspace to configure replay state for hung GPU contexts. The exec_queue_set_hang_replay_state() function copies user-supplied data into the kernel using vmemdup_user(), which allocates a fresh buffer and duplicates the userspace payload.
The function then assigns the newly allocated pointer directly to q->replay_state without checking whether that field already references an earlier allocation. When userspace invokes the setter more than once on the same execution queue, each prior allocation is orphaned. The kernel loses the only reference to the previous buffer, and the memory cannot be reclaimed until the system reboots.
The upstream commits 4105967 and c5f5001 add a check that returns an error when q->replay_state is already populated. This prevents accidental or malicious re-initialization from leaking memory. The fix is a defensive validation rather than a re-architecture of the state machine.
Root Cause
The root cause is missing state validation before pointer assignment [CWE-401]. The driver treats each call to the setter as a first-time initialization and does not free or reject prior allocations tied to q->replay_state.
Attack Vector
A local user with permission to open the drm/xe device node can trigger the leak by repeatedly invoking the affected ioctl against a single execution queue. Each call consumes kernel memory proportional to the user-supplied buffer size. Sustained abuse produces resource exhaustion and can destabilize the host.
The vulnerability is described in the Linux stable tree commits. See the Kernel Git Commit 4105967 and Kernel Git Commit c5f5001 for the applied patches.
Detection Methods for CVE-2026-74699
Indicators of Compromise
- Steady growth in kernel slab or vmalloc accounting on hosts running the Xe DRM driver with no corresponding workload increase
- Unexpected Out of memory kills or allocation failures on systems with Intel graphics workloads
- Processes repeatedly issuing ioctls against /dev/dri/card* nodes tied to the Xe driver
Detection Strategies
- Monitor /proc/meminfo and /proc/vmallocinfo for sustained growth in kernel allocations linked to graphics workloads.
- Audit local processes that hold long-lived file descriptors to /dev/dri/* and invoke queue-configuration ioctls at high rates.
- Compare installed kernel package versions against distribution advisories referencing commits 4105967 and c5f5001.
Monitoring Recommendations
- Enable kernel memory leak detection (kmemleak) in test and staging environments to surface unfreed allocations from the Xe driver.
- Track kernel version inventory across the fleet to identify hosts still running vulnerable drm/xe code.
- Alert on abnormal ioctl call volumes to DRM device nodes from non-graphics processes.
How to Mitigate CVE-2026-74699
Immediate Actions Required
- Apply the vendor-supplied kernel update that includes commits 4105967 and c5f5001 as soon as it becomes available for your distribution.
- Restrict access to /dev/dri/* device nodes to trusted users and graphics service accounts.
- Reboot affected hosts after patching to clear any memory already leaked by the vulnerable driver.
Patch Information
The fix was cherry-picked from upstream commit f6b6cc1118bdbc4265fa8b3bdf8565b26f13e56e and lands in stable branches through the Kernel Git Commit 4105967 and Kernel Git Commit c5f5001. The patch adds an early-return error path when q->replay_state is already populated, preventing the overwrite that caused the leak.
Workarounds
- Where the Xe driver is not required, blacklist the xe kernel module to eliminate the attack surface entirely.
- Constrain local user permissions on multi-tenant hosts to prevent untrusted accounts from opening DRM device nodes.
- Schedule periodic reboots of long-running systems until the patch is deployed to reclaim leaked kernel memory.
# Blacklist the xe module on systems that do not require it
echo "blacklist xe" | sudo tee /etc/modprobe.d/blacklist-xe.conf
sudo update-initramfs -u
# Verify the running kernel version against patched builds
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
