Linux kernel drm/xe: Stale list entry after final framebuffer unpin
Summary
A flaw in the Linux kernel graphics driver drm/xe for Intel Xe GPUs leaves a buffer object linked on a kernel pinned list after its final unpin, when it was pinned both externally and as a display framebuffer. Once that buffer is freed, the stale list entry points to freed memory, which can corrupt the list and lead to a use-after-free. Exploitation requires local access with low privileges, and the CVSS score is 7.8 (High).
Affected
- Linux kernel drm/xe driver (Intel Xe GPUs), introduced in 6.8 - Per the CNA record, affected from commit 44e694958b95395bd1c41508c88c8ca141bf9bd7 up to the fix commits - Unknown whether specific distribution kernel packages are affected
Fixed in
- Linux kernel 6.18.57 and 7.2.11 according to OSV and the CNA record (versions 6.18.x from 6.18.57 and 7.2.11 onward) - Fix commits: 3a11adcfd9a2de74d405bd3e8c4d7a1b328e4684, b3eaff982839e5c22912d604cd8e7748cece8d63, cf238c067eaae1cbfb00738e29219b9568d2313e - Distribution fix status: unknown, check the vendor tracker
Workaround
Unknown. No workaround is documented in the sources reviewed.
Exploitation
- Not listed in CISA KEV - No public proof of concept or exploitation found in the sources reviewed - EPSS is very low (0.00179)
Our recommendation
- Identify Linux systems with Intel Xe-class GPUs, especially multi-user workstations and thin clients - Install the kernel update from your distributor that includes the fix commits as part of the normal patch cycle - Re-check NVD and the distributor trackers for the final fixed version before reporting to customers - Headless servers without Intel Xe GPUs have a lower priority but should still receive regular kernel updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable fix commit 3a11adcf git.kernel.org
- Linux stable fix commit b3eaff98 git.kernel.org
- Linux stable fix commit cf238c06 git.kernel.org
- NVD entry via Vulners vulners.com
- Ubuntu CVE tracker ubuntu.com
- Strix CVE summary www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:31.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin xe_bo_pin_external() and xe_bo_unpin_external() maintain the bo's pinned_link list membership in xe->pinned.late.external, based on whether the current call is the outermost pin or the final unpin. However, the same external bo's pin_count can also be raised and lowered directly by __xe_pin_fb_vma()/__xe_unpin_fb_vma(), which pin the bo as a display scanout buffer without going through xe_bo_pin_external()/xe_bo_unpin_external() at all, and have no notion of, or ownership over, pinned_link. If a bo is pinned both externally (e.g. dma-buf export) and as an fb, and the external unpin happens first, xe_bo_unpin_external() correctly observes pin_count > 1 and leaves the bo on pinned_link. When the fb unpin later performs the true last unpin (pin_count 1 -> 0), it never touches pinned_link, leaving the bo linked on xe->pinned.late.external indefinitely. Once the bo is subsequently freed, this stale list entry points into freed memory, corrupting the list and risking a use-after-free the next time the list is walked or spliced. The backup object pin/unpin sites in xe_bo_notifier_prepare_pinned()/ xe_bo_notifier_unprepare_pinned() have the same bypass characteristic, though they never add their bo to a pinned list, so are not affected by this particular list-corruption issue. Move the pinned_link removal into xe_bo_account_unpin(), which already runs on every unpin path (kernel, external, framebuffer, backup object) right before the true 1 -> 0 pin_count transition. Since list_del_init() only operates on the node itself, this removal is list-agnostic and safe to perform regardless of which list (external or kernel_bo_present) the bo happens to be linked on, or which code path is performing the final unpin. Drop the now-redundant explicit list_del_init() calls in xe_bo_unpin_external() and xe_bo_unpin(). v2: - New patch v3: - Rebased on changes to previous patch. (cherry picked from commit ca58d36a1f93af586ee93b340c9f9fd81312cc01)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.