HIGH
drm/xe NVM Double-Free
CVE-2026-23162
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/xe/nvm: Fix double-free on aux add failure After a successful auxiliary_device_init(), aux_dev->dev.release (xe_nvm_release_dev()) is responsible for the kfree(nvm). When there is failure with auxiliary_device_add(), driver will call auxiliary_device_uninit(), which call put_device(). So that the .release callback will be triggered to free the memory associated with the auxiliary_device. Move the kfree(nvm) into the auxiliary_device_init() failure path and remove the err goto path to fix below error. " [ 13.232905] ================================================================== [ 13.232911] BUG: KASAN: double-free in xe_nvm_init+0x751/0xf10 [xe] [ 13.233112] Free of addr ffff888120635000 by task systemd-udevd/273 [ 13.233120] CPU: 8 UID: 0 PID: 273 Comm: systemd-udevd Not tainted 6.19.0-rc2-lgci-xe-kernel+ #225 PREEMPT(voluntary) ... [ 13.233125] Call Trace: [ 13.233126] <TASK> [ 13.233127] dump_stack_lvl+0x7f/0xc0 [ 13.233132] print_report+0xce/0x610 [ 13.233136] ? kasan_complete_mode_report_info+0x5d/0x1e0 [ 13.233139] ? xe_nvm_init+0x751/0xf10 [xe] ... " v2: drop err goto path. (Alexander) (cherry picked from commit a3187c0c2bbd947ffff97f90d077ac88f9c2a215)
02KernelScan AI Analysis
Risk summary
A memory corruption vulnerability in the Intel Xe GPU driver that can cause kernel crashes during driver initialization. While it requires local access and specific hardware, it could be exploited by unprivileged users to cause denial of service through system crashes when the GPU driver is loaded.
Vulnerability analysis
Root Cause: The xe_nvm_init() function had incorrect memory management for the NVM auxiliary device structure. After auxiliary_device_init() succeeds, the device's release callback (xe_nvm_release_dev) becomes responsible for freeing the memory. However, when auxiliary_device_add() failed, the code would call auxiliary_device_uninit() which triggers put_device() and the release callback, but then also manually call kfree(nvm) in the error path, resulting in a double-free.
Attack Surface: This is a local vulnerability that occurs during GPU driver initialization when the xe DRM driver is loaded. It requires physical access to a system with Intel Xe graphics hardware and the ability to trigger driver loading/unloading, typically through device hotplug or module operations.
Fix Mechanism: The patch moves the kfree(nvm) call to only occur in the auxiliary_device_init() failure path, where the release callback hasn't been set up yet. For auxiliary_device_add() failures, it removes the manual kfree() and lets the release callback handle the memory cleanup through auxiliary_device_uninit(). The error handling goto path is also simplified.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.18 | 6.18.9 | 32887d8e4bc0 |
| mainline | 6.19 | 8a44241b0b83 |