HIGH
drm/xe SysfsInit UAF
CVE-2026-46264
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI4.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Fix sysfs initialization In case of devm_add_action_or_reset() failure the provided cleanup action will be run immediately on the not yet initialized kobject. This may lead to errors like: [ ] kobject: '(null)' (ff110001393608e0): is not initialized, yet kobject_put() is being called. [ ] WARNING: lib/kobject.c:734 at kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9 [ ] RIP: 0010:kobject_put+0xdf/0x250 [ ] Call Trace: [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe] [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe] [ ] xe_sriov_init_late+0x5f/0x2c0 [xe] [ ] xe_device_probe+0x5f2/0xc20 [xe] [ ] xe_pci_probe+0x396/0x610 [xe] [ ] local_pci_probe+0x47/0xb0 [ ] refcount_t: underflow; use-after-free. [ ] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9 [ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0 [ ] Call Trace: [ ] kobject_put+0x174/0x250 [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe] [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe] [ ] xe_sriov_init_late+0x5f/0x2c0 [xe] [ ] xe_device_probe+0x5f2/0xc20 [xe] [ ] xe_pci_probe+0x396/0x610 [xe] [ ] local_pci_probe+0x47/0xb0 Fix that by calling kobject_init() and kobject_add() separately and register cleanup action after the kobject is initialized. Also make this cleanup registration a part of the create helper to fix another mistake, as in the loop we were wrongly passing parent kobject while registering cleanup action, and this resulted in some undetected leaks. (cherry picked from commit 98b16727f07e26a5d4de84d88805ce7ffcfdd324)
02KernelScan AI Analysis
Risk summary
Systems with Intel Xe GPUs supporting SR-IOV are vulnerable to a kernel oops during PF driver initialization. The bug is triggered when a devm cleanup action is registered on an uninitialized kobject and subsequently runs due to registration failure (e.g., under memory pressure). Exploitation requires root privileges to trigger PCI driver probe or rebinding.
Vulnerability analysis
The vulnerability exists in the SR-IOV PF sysfs initialization path. create_xe_sriov_kobj() allocates a kobject via kzalloc but returns it without initializing the embedded kobject. The caller then registers a devm cleanup action with devm_add_action_or_reset() that invokes kobject_put() on this uninitialized object. If devm_add_action_or_reset() fails (typically ENOMEM), the cleanup action runs immediately, causing kobject_put() to WARN because state_initialized is false, and a subsequent refcount_t underflow WARN because the reference count was never set to 1. The system typically recovers, but if panic_on_warn is set a kernel panic occurs. The secondary issue in the same loop incorrectly passed the parent kobject to the cleanup action, causing reference leaks. Reachability is limited to the PCI probe path, which requires root privileges to trigger via driver bind/unbind or module load.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.19 | 6.19.4 | 6ae479b1919e |
| mainline | 7.0 | bf7172cd25ed |