Linux kernel Intel Xe dma-buf import: retry loop reuses a buffer object that was already freed
Impact
The dma-buf import path retried after failure, but the buffer object is freed on the error return, so the retry touched freed memory - a use-after-free in the GPU driver reachable from the import ioctl. The fix restructures allocation and init into one unit so the retry operates on a live object. A kernel use-after-free driven from a render node is the classic container-to-host escalation shape on a GPU box: the attacker is already on the node and only needs the GPU device that their workload legitimately has. Red Hat has shipped errata for RHEL, which is the signal that this is being treated as a real local privilege-escalation risk rather than a tidy-up. Only hosts running drm/xe for Intel GPUs are affected.
Who can reach it
Local, authenticated. Any tenant with a /dev/dri render node on an Intel Xe GPU who can make a dma-buf import fail and retry. No remote path.
What to do
Patch to a fixed stable or distribution kernel - RHSA-2026:42919 and RHSA-2026:45192 carry it for RHEL - and reboot each affected GPU node. No live mitigation exists short of denying render-node access to untrusted workloads. Plan a drain and reboot per node; on a shared Intel GPU cloud this one is worth a dedicated window rather than waiting for the quarterly kernel roll.
References
Related entries
- Linux kernel Intel Xe dma-buf: attaching before init exposes an empty or freed buffer object to the exporterCVE-2026-52951 · Linux kernel drm/xe dma-buf (attach before buffer-object init, invalidate_mappings races)High
- Linux kernel Intel Xe: exec queue creation error paths free a queue still linked into VM and engine-group listsCVE-2026-52976 · Linux kernel drm/xe (xe_exec_queue_create_ioctl error paths)High
- Linux kernel amdgpu user-mode queues (doorbell submission path) (drm/amdgpu): A double free in the amdgpu user-modeCVE-2026-52987 · Linux kernel amdgpu user-mode queues (doorbell submission path) (drm/amdgpu)High
- Linux kernel amdgpu display core (DC/DM) (drm/amd/display): An out-of-bounds access in the amdgpu display core (DC/DM)CVE-2026-53136 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High
- Linux kernel amdgpu display core (DC/DM) (drm/amd/display): An out-of-bounds access in the amdgpu display core (DC/DM)CVE-2026-53137 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High
- Linux DRM GEM: race between gem_change_handle and gem_close leaves a freed object in the handle tableCVE-2026-53145 · Linux kernel DRM GEM (DRM_IOCTL_GEM_CHANGE_HANDLE)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.