Linux kernel drm/xe/oa: exec_queue reference leak pins queue and file state indefinitely
Impact
In xe_oa_stream_open_ioctl(), an early -EOPNOTSUPP return for exec queues with width > 1 skips the error cleanup path and leaks the exec_queue reference taken by xe_exec_queue_lookup(). The leaked reference keeps the exec queue and the xe_file private state pinned for the lifetime of the kernel, and because the reference is not in the file's exec_queue xarray, closing the file cannot release it. A local user with access to the Intel GPU device node can repeat the failing ioctl to leak kernel memory until the node must be rebooted. This affects the Intel xe driver, so it is relevant only to fleets running Intel datacenter GPUs (Ponte Vecchio / Battlemage-class); nodes with NVIDIA or AMD accelerators are unaffected.
Who can reach it
Local user holding an open Intel GPU DRM device node (any tenant with a GPU container that exposes /dev/dri on an xe-driven node). Authentication to the node is required; no remote path.
What to do
Update to a kernel carrying the fix (stable commits 04ef7592eaad, 4b0c4f0c1b13, 4d25342543c0; upstream 339fa0be9e4a) and drain and reboot each affected node. Fleets not using Intel GPUs or not loading the xe driver are not exposed and can defer.
References
Related entries
- NVIDIA License System - DLS virtual appliance: Installation scripts on the DLS appliance leave other users' credentialsCVE-2022-21818 · NVIDIA License System - DLS virtual applianceMedium
- Triton Inference Server: Insufficient access-control granularityCVE-2024-0103 · Triton Inference ServerMedium
- Intel Gaudi / gaudi-container-runtime: A path-traversal bug in the container runtime shim that wires Gaudi devices intoCVE-2026-32677 · Intel Gaudi / gaudi-container-runtimeMedium
- NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Improper access control in the escape handler leaks informationCVE-2021-1055 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)Medium
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): An off-by-one error in nvidia.ko permits data tamperingCVE-2022-34684 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)Medium
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): An out-of-bounds array access in nvidia.ko givesCVE-2022-42254 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.