Linux kernel drm/xe: user fence reference leaked when chain fence allocation fails

CVSS 5.5CVE-2026-43396NVIDIA / GPU stackcurated

Impact

When dma_fence_chain_alloc() fails inside Xe sync handling, the user fence reference is never released. This is a separate leak from CVE-2026-43395 with its own fix commit: it triggers on allocation failure rather than on a parse error path, so a tenant that can drive the host into allocation pressure makes each failed submission leak a kernel object, compounding the memory shortage. The end state is availability loss on the GPU node rather than any data exposure (vector reports C:N/I:N/A:H).

Who can reach it

Local, authenticated: a user or container with access to an Xe DRM render node that can submit work with sync objects. Requires the allocation to actually fail, so it is realistic only under memory pressure the attacker or the workload mix creates.

What to do

Apply the stable kernel release containing the fix (commit a5d5634cde48 cherry-picked to stable) and reboot each affected node; drain GPU jobs before the reboot. No published workaround other than limiting who can open the Xe render nodes.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-43396 https://git.kernel.org/stable/c/f8f90b33934b307f6e4599b9fae38aa1ee5441a7 https://git.kernel.org/stable/c/0879c3f04f67e2a1677c25dcc24669ce21eb6a6c

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.