Linux kernel drm/xe: final framebuffer unpin leaves a stale pinned-list entry and risks use-after-free

Impact

xe_bo_unpin_external() owns the buffer object's membership of xe->pinned.late.external, but __xe_unpin_fb_vma() can perform the true last unpin without touching that list. A buffer pinned both as a dma-buf export and as a display scanout framebuffer, where the external unpin happens first, stays linked on the pinned list forever; once freed, the list points into freed memory and the next walk or splice of that list can corrupt it or hit a use-after-free. Read the reachability before scheduling anything: the trigger requires the display framebuffer pin path, and Intel's datacenter Xe parts are run headless with no KMS scanout, so on a GPU compute node this combination does not occur. The realistic exposure is Xe-driven machines that do drive a display - developer and workstation boxes inside the fleet - where a local user with DRM access could reach it. The kernel's generic local 7.8 score does not reflect that narrowing.

Who can reach it

Local user with /dev/dri access on a machine running the xe driver with an active display pipeline, able to both export a buffer as dma-buf and pin it as a framebuffer. No authentication beyond device access. Not reachable on headless GPU nodes, which never take the fb-pin path.

What to do

Roll the fix in with your next scheduled kernel update and reboot; given the display-only trigger, headless GPU nodes do not need an out-of-band maintenance window for this one. Any workstation-class host on the xe driver should be rebooted onto the fixed kernel with the normal cadence. No vendor mitigation is published and there is no userspace knob to close the path.

References

Related entries

• Linux drm/i915: execbuffer relocation cleanup frees past the exec array after command-parser VMAsCVE-2026-99006 · Linux kernel drm/i915 GEM execbuffer (relocation cleanup past the exec array)High
• NVIDIA GPU Display Driver - kernel mode layer (Windows nvlddmkm.sys and Linux nvidia.ko): An out-of-bounds readCVE-2022-28183 · NVIDIA GPU Display Driver - kernel mode layer (Windows nvlddmkm.sys and Linux nvidia.ko)High
• DGX servers BMC: Improper access control on BMCCVE-2022-42275 · DGX servers BMCHigh
• KAI Scheduler: Missing authentication on API endpointsCVE-2026-24177 · KAI SchedulerHigh
• AMD RCCL: unvalidated peer input lets a compromised rank dereference an attacker-controlled pointerCVE-2026-43598 · AMD RCCL (ROCm Communication Collectives Library) peer rank handlingHigh
• NVIDIA Windows GPU driver: out-of-bounds read with no privileges required, leaking data and crashing the driverCVE-2026-47576 · NVIDIA GPU Display Driver for Windows (kernel module)High