Linux drm/xe: use-after-free when closing an EU stall sampling stream

CVSS 7.8CVE-2026-53290NVIDIA / GPU stackcurated

Impact

Closing an EU stall profiling stream drops the DRM device reference before the stream is disabled and its buffers are freed. If that was the last reference, the cleanup path then touches device structures that have already been released - a use-after-free driven entirely by a close() on a file the profiling user already owns. This matters on Intel datacenter GPUs managed by the xe driver, where EU stall sampling is a profiling feature a tenant or a performance engineer can be given access to; the flaw lives in the driver, so the blast radius is the host kernel on the GPU node, not just the profiling process. Local only, scored 7.8 by NVD.

Who can reach it

Local user able to open an xe EU stall sampling stream on a DRM device - i.e. someone with GPU device access and whatever profiling permission the node grants. No authentication over the network is involved.

What to do

Update to a stable kernel containing the reordered drm_dev_put() (cherry-picked from 35aff528f729). Requires drain and reboot of each affected Intel GPU node; as an interim mitigation, deny access to EU stall sampling on shared nodes. No vendor advisory beyond the kernel commits in this record.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-53290 https://git.kernel.org/stable/c/84f2bfbe6e38f8b9815ca00826e53b7f51420402 https://git.kernel.org/stable/c/bebce43f34b5feb8a760aa832eba81e0f8a38871 https://git.kernel.org/stable/c/dc2d9842c67d883d3200ae33b9c3859dd9492408

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.