CVE-2026-53142: Linux xe Display Driver Kernel Panic on Suspend/Shutdown

Technical summary

CVE-2026-53142 is a null pointer dereference vulnerability in the xe display driver's suspend and shutdown path. The vulnerability stems from a mismatch between the probe_display flag and actual display hardware presence. While xe->info.probe_display is initially set based on intel_display_device_probe() results, display can be disabled later by hardware fuses, detected during intel_display_device_info_runtime_init(). The driver fails to synchronize probe_display with the actual device state, causing xe_display_flush_cleanup_work() to invoke for_each_intel_crtc() on an uninitialized mode config structure. The fix adds a check for intel_display_device_present() post-runtime-init and resets probe_display and display features accordingly, mirroring the i915 driver's approach.

Business impact

This vulnerability creates a denial of service risk for organizations deploying systems with Intel GPUs featuring hardware-disabled display outputs. Affected systems will experience kernel panics during shutdown or suspend operations, disrupting normal system management, scheduled maintenance, and power cycling procedures. While not a direct data breach risk, the crashes can lead to unplanned downtime, complications in fleet management, and potential data loss if systems fail to shut down cleanly. The impact is localized to specific Intel hardware configurations but can affect server deployments relying on graceful power transitions.

Affected systems

The vulnerability affects the Linux kernel with the xe graphics driver, which is the newer Intel GPU driver targeting Arc GPUs and newer Intel integrated graphics. Systems are vulnerable only when running a kernel version containing the affected code and possessing Intel display hardware that is disabled via fuses. This typically includes Intel Arc discrete GPUs and newer client/server platforms with integrated graphics where BIOS or hardware fuses disable display output. The vulnerability is not present in systems using the older i915 driver or in non-Intel GPU environments.

Exploitability

This is not an exploitable vulnerability in the traditional sense. It requires local system access (privilege level is 'L' per CVSS), triggering only during suspend or shutdown operations. An authenticated local user cannot remotely trigger the crash, and the condition depends on specific hardware configurations with display disabled at the firmware level. The vulnerability manifests as a reliability issue rather than a security bypass, affecting system stability rather than security posture. Exploitation requires no special tools or knowledge—simply initiating a suspend or shutdown on affected hardware.

Remediation

The fix involves updating the xe driver's display initialization logic to properly detect and respond to hardware-disabled display states. The remedy requires kernel patching to incorporate the logic that rechecks display device presence after runtime initialization and synchronizes the probe_display flag accordingly. Verify against the Linux kernel security advisories and your distribution's kernel update channels for the patched version. Systems should prioritize applying the update during regular maintenance windows, as the vulnerability only manifests during power transitions and does not affect active system operation.

Patch guidance

Apply kernel updates from your Linux distribution as they become available with this fix integrated. Verify that the kernel changelog includes resolution of CVE-2026-53142 in the xe display driver. For distributions delivering xe driver support (primarily those targeting newer Intel hardware), check official security advisories for the minimum patched kernel version. If using a custom kernel, ensure cherry-picking or backporting of commit 7c3eb9f47533 or equivalent display driver fixes. Test patches in non-production environments first, particularly on systems with Intel Arc GPUs or discrete display configurations.

Detection guidance

Monitor system logs for kernel panic dumps or oops messages referencing xe_display_flush_cleanup_work(), for_each_intel_crtc(), or display-related NULL pointer dereference crashes during suspend/shutdown operations. Use kdump or crash dump analysis to confirm stack traces pointing to the xe display driver initialization path. In production environments, correlate unexpected shutdown delays or failed power transitions on Intel Arc GPU systems with kernel error logs. Proactive detection is difficult without triggering the condition; ensure test systems with affected hardware configurations exercise suspend/shutdown paths during validation.

Why prioritize this

While assigned a MEDIUM CVSS score (5.5) reflecting local-only access and denial of service impact, prioritize patching based on your deployment footprint. Organizations heavily using Intel Arc GPUs or newer Intel systems with display disabled at firmware level should treat this as higher priority due to operational impact during maintenance windows. Conversely, organizations without affected Intel hardware can defer patching to standard maintenance cycles. The lack of remote exploitability or data breach potential keeps this below critical tier, but the reliability risk justifies prompt remediation for affected deployments.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM severity) reflects: Attack Vector Local (requires direct system access), Attack Complexity Low (triggers reliably on affected hardware during normal operations), Privileges Required (Low—an authenticated local user can trigger), User Interaction (None), Scope (Unchanged), with high Availability impact (denial of service via kernel panic). Confidentiality and Integrity impacts are zero. The score appropriately captures that this is a local-only reliability issue without privilege escalation or data exfiltration potential. The lack of EPSS or KEV designation aligns with the non-critical nature but does not diminish its operational importance for affected users.

Frequently asked questions