CVE-2026-52976: Linux XE GPU Driver Use-After-Free Privilege Escalation

Technical summary

The vulnerability resides in xe_exec_queue_create_ioctl() in the XE GPU driver. Two distinct error paths fail to perform necessary cleanup: (1) When xe_hw_engine_group_add_exec_queue() fails after xe_vm_add_compute_exec_queue() has succeeded (relevant in preempt fence mode), the error handler skips xe_exec_queue_kill(), leaving the queue on the VM's compute exec queue list as a dangling pointer. (2) When xa_alloc() fails after the hw engine group addition succeeds, xe_hw_engine_group_del_exec_queue() is never called, leaving the queue linked into the hw engine group structure while the memory is freed. Both scenarios create use-after-free conditions (CWE-416, CWE-825) exploitable by dereferencing the freed pointers in subsequent operations.

Business impact

A successful exploit could allow an unprivileged local user to escalate to kernel privileges, read sensitive kernel memory, modify kernel state, or trigger a denial of service. On multi-tenant or shared-user systems, this threatens confidentiality, integrity, and availability. Graphical workstations and servers running GPU workloads are at risk. The impact is severe: an attacker with login access but no special privileges can elevate fully or crash critical services relying on the GPU driver.

Affected systems

Systems running the Linux kernel with the XE (Intel Data Center GPU) driver are affected. This impacts modern Linux distributions supporting Intel Arc GPUs, Data Center GPU Flex, and Data Center GPU Max series. Affected kernel versions are those before the fix commit 37c831f401746a45d510b312b0ed7a77b1e06ec8. Check your kernel version and verify whether XE driver is compiled in (common in recent distributions with GPU support). Older kernels without XE support are not affected.

Exploitability

Exploitability is high but requires local access. The CVSS score of 7.8 reflects local attack vector (AV:L) with low complexity (AC:L) and only standard user privilege requirement (PR:L). An attacker needs to trigger the specific error conditions during execution queue creation, which may require crafted ioctl calls to the DRM subsystem. No network exploitation is possible, and no user interaction is required beyond the attacker's own malicious actions. The issue is not known to be actively exploited (not in CISA KEV catalog as of publication), but the fix addresses a straightforward memory safety bug with clear exploit potential.

Remediation

Update the Linux kernel to a version containing the fix (cherry-picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8). Verify the fix is present in your distribution's kernel update. If immediate patching is not possible, restrict non-administrative user access to GPU devices (e.g., via group membership or device permissions) to reduce local attack surface. Monitor systems for suspicious GPU driver ioctl activity or kernel crashes related to DRM/XE.

Patch guidance

This vulnerability was fixed via backport of commit 37c831f401746a45d510b312b0ed7a77b1e06ec8. Watch your Linux distribution's security advisories for kernel updates incorporating this fix. Ubuntu, Fedora, RHEL, and other distributions will release patched kernel images; apply these updates promptly. Verify patch inclusion by checking the kernel changelog for mention of 'xe_exec_queue_create_ioctl' error handling or 'del_hw_engine_group' label additions. Test in a non-production environment first, as kernel updates may require reboot.

Detection guidance

Monitor kernel logs for use-after-free warnings or page faults in the XE driver module (dmesg output). Watch for crashes with stack traces mentioning xe_exec_queue_create_ioctl, xe_hw_engine_group functions, or xe_vm_add_compute_exec_queue. Audit GPU device access via 'ls -l /dev/dri/*' and restrict to necessary users. Tools like systemtap or eBPF can monitor DRM ioctl calls, though detection of exploitation is challenging post-compromise. Focus on timely patching over post-exploitation detection.

Why prioritize this

Prioritize this vulnerability for patching because it enables privilege escalation from local user to kernel level with low complexity. While it requires local access and is not yet publicly exploited, the attack surface is typical (ioctl interface) and the bug is a clear memory safety issue. Systems with GPU workloads and multi-user environments face elevated risk. Although CVSS is 7.8 rather than critical, the privilege escalation pathway and ease of exploitation in the right context justify high priority treatment.

Risk score, explained

CVSS 7.8 (HIGH) is assigned due to: Local attack vector and low complexity (standard user can trigger via ioctl); high impact on confidentiality, integrity, and availability (kernel memory access enables full compromise); and requirement for only low privileges (authenticated local user). The score does not account for lack of active exploitation or KEV listing, which factors favor earlier remediation rather than emergency patching. Organizations should treat this as important but not critical-priority (8.0+) patching.

Frequently asked questions