CVE-2026-46224: Linux Xe DRM Memory Leak DoS Vulnerability – Patch Guidance

Technical summary

CVE-2026-46224 is a resource management flaw in xe_dma_buf_init_obj() within the Xe DRM driver (drivers/gpu/drm/xe/). When drm_gpuvm_resv_object_alloc() fails during DMA buffer initialization, the function returns an error without freeing the pre-allocated storage buffer object (storage bo). Since xe_dma_buf_init_obj() calls xe_bo_init_locked(), which frees the bo on its own error paths, the calling function xe_gem_prime_import() cannot reliably determine ownership semantics and safely decide whether to free the buffer. The fix adds an explicit xe_bo_free(storage) call before error return paths and clarifies ownership documentation: on success, storage is transferred to the returned drm_gem_object; on failure, storage is freed before returning.

Business impact

This vulnerability enables a local, unprivileged user to trigger memory leaks in the kernel's GPU memory management subsystem. By repeatedly triggering allocation failures in the Xe DMA buffer initialization path, an attacker could gradually exhaust system memory, eventually causing system instability or denial of service. The impact is limited by the requirement for local system access and non-root privileges. For organizations running GPU-accelerated workloads on vulnerable Linux systems (especially in shared multi-tenant environments or when untrusted users have shell access), this represents a denial-of-service risk rather than data breach or privilege escalation.

Affected systems

The vulnerability affects all Linux kernel versions that include the Xe DRM driver code with the unfixed xe_dma_buf_init_obj() function. This primarily impacts systems using Intel Arc GPUs on Linux, where the Xe driver is required. The affected code path is activated when user-space applications request DMA buffer import operations. Systems using other GPU drivers (NVIDIA, AMD) are not affected; only systems with Xe DRM driver are vulnerable.

Exploitability

This vulnerability has a CVSS 3.1 score of 5.5 (MEDIUM) with attack vector Local, Attack Complexity Low, Privilege Requirements Low, and User Interaction None. Exploitation requires an unprivileged local user account on the target system. An attacker would need to repeatedly invoke DMA buffer operations that trigger the allocation failure path. The low complexity and lack of user interaction requirement make this relatively straightforward to trigger, though the impact (memory exhaustion) may take time to manifest depending on system memory size and workload patterns. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Apply the kernel patch that adds the missing xe_bo_free(storage) call in xe_dma_buf_init_obj() error paths (cherry-picked from commit 78a6c5f899f22338bbf48b44fb8950409c5a69b9). This fix ensures proper memory cleanup on allocation failure and clarifies ownership semantics between xe_dma_buf_init_obj() and its caller. Verify the patch version against your Linux distribution's security advisory or kernel.org for the specific kernel version you are running.

Patch guidance

Obtain the patch through your Linux distribution's security update mechanism (e.g., apt, yum, dnf, zypper) or from kernel.org. The fix is minimal and surgical, adding xe_bo_free(storage) calls and clarifying comments—low risk of regression. Patch and reboot at your earliest maintenance window; kernel memory leaks can compound over time. Verify the patched kernel includes commit 78a6c5f899f22338bbf48b44fb8950409c5a69b9 in the Xe driver code. Test GPU workloads after patching to confirm normal operation.

Detection guidance

Monitor kernel memory usage and GPU memory allocation patterns for unexplained growth, particularly on systems where untrusted users have shell access or GPU access. Kernel dmesg logs may show signs of memory pressure or OOM (Out of Memory) events if the leak is triggered repeatedly. If possible, enable audit logging on DMA buffer operations. Detection is challenging at the application level; kernel-level monitoring or memory accounting tools (e.g., memusage, memory cgroups) are more effective. Check /proc/meminfo and GPU memory counters for sustained increases without corresponding workload growth.

Why prioritize this

This medium-severity vulnerability should be prioritized for patching because it enables local denial of service in environments where untrusted users have system access, particularly in multi-tenant GPU compute clusters or shared development systems. While not as critical as remote code execution vulnerabilities, memory exhaustion attacks are difficult for users to distinguish from legitimate resource contention and can silently degrade system reliability. Organizations running Xe GPU drivers should patch within one or two maintenance cycles; others are unaffected and can defer.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects the attack complexity (low), local attack vector, requirement for low privileges, and availability impact (high). The score does not include confidentiality or integrity impact, as this is purely a denial-of-service through resource exhaustion. The score appropriately reflects medium risk: this is not a privilege escalation or remote attack, but it does enable a credible local DoS attack that could disrupt GPU-accelerated services.

Frequently asked questions