CVE-2026-80903: Linux Kernel Information Disclosure Vulnerability

CVE-2026-80903 Overview

CVE-2026-80903 is a memory leak vulnerability in the Linux kernel's Intel Xe graphics driver, specifically within the Observation Architecture (OA) subsystem. The flaw resides in xe_oa_emit_oa_config(), which only releases sync entries and the syncs array on its success path. When the function fails before reaching the point of no return, the parsed syncs and their fence references leak. Subsequent config ioctl calls overwrite stream->syncs, permanently orphaning the leaked memory.

Critical Impact
Repeated failure paths in OA configuration ioctls leak kernel memory and dma-fence references, potentially exhausting kernel resources on systems using Intel Xe graphics.

Affected Products

Linux kernel versions containing the Intel Xe DRM driver with the xe_oa observation architecture subsystem
Systems running Intel discrete or integrated GPUs supported by the Xe driver
Distributions shipping mainline kernels prior to the fix commit 8af97b3da2cf

Discovery Timeline

2026-09-04 - CVE-2026-80903 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80903

Vulnerability Analysis

The vulnerability affects the Intel Xe Direct Rendering Manager (DRM) driver's Observation Architecture (OA) code path, which is used for GPU performance counter collection. The function xe_oa_emit_oa_config() accepts parsed sync entries stored in stream->syncs and is responsible for releasing them upon successful submission of the OA configuration batch.

When the function fails before the point of no return, such as during fence allocation, config buffer allocation, or batch submission, it returns without cleaning up stream->syncs. The stream open path handles these failures in its caller. However, xe_oa_config_locked() simply propagates the error without invoking any cleanup routine.

As a result, both the syncs array itself and the fence references held by each parsed entry remain allocated. A subsequent OA config ioctl overwrites stream->syncs, making the original allocation permanently unreachable and preventing fence reference release.

Root Cause

The root cause is an asymmetric cleanup contract between xe_oa_emit_oa_config() and its callers. The success path frees resources internally, but failure paths depend on caller-side cleanup that xe_oa_config_locked() never performs. This mismatch produces a classic memory leak pattern in kernel error handling.

Attack Vector

A local user with permission to open an Xe OA stream and issue OA configuration ioctls can trigger the failure path repeatedly. Each failed configuration attempt leaks kernel memory and dma-fence references. Sustained exploitation could lead to kernel memory exhaustion and denial of service conditions on the affected host.

No verified proof-of-concept code has been published. See the upstream fix commits referenced below for technical details on the code paths involved.

Detection Methods for CVE-2026-80903

Indicators of Compromise

Steadily growing kernel slab allocations associated with dma-fence objects on systems using Intel Xe GPUs
Elevated counts of unreleased sync objects reported via /proc/slabinfo or slabtop over time
Repeated DRM_IOCTL_XE_OBSERVATION calls from unprivileged processes followed by error returns

Detection Strategies

Monitor kernel logs for repeated OA configuration failures originating from the same process or user context
Audit process behavior for abnormal rates of ioctl() calls against /dev/dri/renderD* device nodes
Track kernel memory growth trends on GPU-equipped workstations and correlate with graphics-related workloads

Monitoring Recommendations

Enable kernel memory leak detection via kmemleak on test systems to validate patch application
Collect endpoint telemetry on unusual ioctl usage patterns from non-graphics processes
Baseline slab allocator statistics on Xe-enabled hosts to identify anomalous fence or sync growth

How to Mitigate CVE-2026-80903

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits 027150e, 8d33c49, 948f346, and fcf7943 as soon as vendor updates are available
Prioritize patching workstations, developer systems, and virtualization hosts using Intel Xe graphics
Restrict access to DRM render nodes where feasible to trusted user sessions only

Patch Information

The fix is cherry-picked from upstream commit 8af97b3da2cfce04e6b457c6eb17ed3c1daf912b. It ensures that xe_oa_emit_oa_config() cleans up parsed sync entries on all failure paths, matching the behavior of the stream open error path. Distribution-provided kernel updates that include the referenced stable backports resolve the leak. See the Kernel Git Commit 8d33c49 and the Kernel Git Commit fcf7943 for the backported changes.

Workarounds

Limit permissions on /dev/dri/renderD* nodes to reduce the pool of users able to trigger OA configuration ioctls
Disable or unload the Xe driver on systems where GPU observation functionality is not required
Reboot systems periodically to reclaim leaked kernel memory until the patch is deployed

bash

# Example: restrict access to DRM render nodes to the video group
sudo chgrp video /dev/dri/renderD*
sudo chmod 660 /dev/dri/renderD*

# Verify kernel version includes the Xe OA fix
uname -r