GPU VulnDB

Database/NVIDIA / GPU stack

Linux kernel Intel Xe: exec queue creation error paths free a queue still linked into VM and engine-group lists

CVSS 7.8CVE-2026-52976NVIDIA / GPU stackcurated

Impact

Two error paths in xe_exec_queue_create_ioctl() free an execution queue that is still on a kernel list. If xe_hw_engine_group_add_exec_queue() fails the path skips xe_exec_queue_kill(), leaving the queue on the VM's compute exec-queue list in preempt-fence mode; if xa_alloc() fails afterwards the queue is freed without being removed from the hardware engine group. Both leave a dangling pointer that the driver later follows - a use-after-free reachable straight from an ioctl any GPU tenant can call. Exec queue creation is a routine, high-frequency operation, and an attacker controls when it fails, which makes this one of the more practically reachable items in this set. Consequence on a shared Intel GPU node is host kernel memory corruption, so the containment boundary between tenants is what is at stake.

Who can reach it

Local, authenticated. Any tenant with a GPU pod holding an Intel Xe render node who can call the exec-queue create ioctl and force it to fail at the right step.

What to do

Patch to a fixed stable or distribution kernel - Red Hat ships it in RHSA-2026:42919 - and reboot each affected node. No mitigation short of removing render-node access. Drain and reboot per Intel Xe node.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-52976https://git.kernel.org/stable/c/1be55646d8a2035343b012dcb12210db7bb8b056https://git.kernel.org/stable/c/753b149d5a433eb19e0c1b0eb4526a6e26120d1fhttps://access.redhat.com/errata/RHSA-2026:42919

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.