CVE-2026-23350

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23350", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.999Z", "datePublished": "2026-03-25T10:27:36.182Z", "dateUpdated": "2026-08-05T12:21:15.714Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:21:15.714Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/queue: Call fini on exec queue creation fail\n\nEvery call to queue init should have a corresponding fini call.\nSkipping this would mean skipping removal of the queue from GuC list\n(which is part of guc_id allocation). A damaged queue stored in\nexec_queue_lookup list would lead to invalid memory reference,\nsooner or later.\n\nCall fini to free guc_id. This must be done before any internal\nLRCs are freed.\n\nSince the finalization with this extra call became very similar to\n__xe_exec_queue_fini(), reuse that. To make this reuse possible,\nalter xe_lrc_put() so it can survive NULL parameters, like other\nsimilar functions.\n\nv2: Reuse _xe_exec_queue_fini(). Make xe_lrc_put() aware of NULLs.\n\n(cherry picked from commit 393e5fea6f7d7054abc2c3d97a4cfe8306cd6079)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached via the DRM_IOCTL_XE_EXEC_QUEUE_CREATE ioctl on the Intel Xe GPU render node (/dev/dri/renderD*), which requires local system access.\nAC:L - The attacker can trigger xe_lrc_create() failure through memory pressure (controllable by a local user) or by using a width > 1 to increase allocation failure probability. No race condition or uncontrollable preconditions are required.\nPR:L - The ioctl is DRM_RENDER_ALLOW, accessible to any unprivileged user who can open the render node device file, which is typically world-accessible on systems with Intel GPUs.\nUI:N - No user interaction is needed; the attacker directly invokes the ioctl.\nS:U - The vulnerability affects the kernel within its own security authority; there is no VM escape or sandbox boundary crossing.\nC:H - This is a use-after-free where the freed queue object remains in the exec_queue_lookup xarray. An attacker can reclaim the freed slab with controlled data, enabling arbitrary kernel memory reads through the stale pointer.\nI:H - The use-after-free allows heap spraying to control the freed object's contents, enabling arbitrary write primitives and potential code execution when the GuC submission code operates on the stale queue pointer.\nA:H - Accessing the freed queue through the dangling pointer in exec_queue_lookup will cause invalid memory references, leading to kernel crashes or panics."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_exec_queue.c", "drivers/gpu/drm/xe/xe_lrc.h"], "versions": [{"version": "3c1fa4aa60b146d1fa73b2b87064303f8e4b7952", "lessThan": "fae65b8a4449ae556990efcde8d74bec4adc5925", "status": "affected", "versionType": "git"}, {"version": "3c1fa4aa60b146d1fa73b2b87064303f8e4b7952", "lessThan": "99f9b5343cae80eb0dfe050baf6c86d722b3ba2e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_exec_queue.c", "drivers/gpu/drm/xe/xe_lrc.h"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fae65b8a4449ae556990efcde8d74bec4adc5925"}, {"url": "https://git.kernel.org/stable/c/99f9b5343cae80eb0dfe050baf6c86d722b3ba2e"}], "title": "drm/xe/queue: Call fini on exec queue creation fail", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_exec_queue.c", "drivers/gpu/drm/xe/xe_lrc.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fae65b8a4449ae556990efcde8d74bec4adc5925", "status": "affected", "version": "3c1fa4aa60b146d1fa73b2b87064303f8e4b7952", "versionType": "git"}, {"lessThan": "99f9b5343cae80eb0dfe050baf6c86d722b3ba2e", "status": "affected", "version": "3c1fa4aa60b146d1fa73b2b87064303f8e4b7952", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_exec_queue.c", "drivers/gpu/drm/xe/xe_lrc.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8ACF56ED-6FE0-41DE-BECE-41134CC7BD44", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*", "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/queue: Call fini on exec queue creation fail\n\nEvery call to queue init should have a corresponding fini call.\nSkipping this would mean skipping removal of the queue from GuC list\n(which is part of guc_id allocation). A damaged queue stored in\nexec_queue_lookup list would lead to invalid memory reference,\nsooner or later.\n\nCall fini to free guc_id. This must be done before any internal\nLRCs are freed.\n\nSince the finalization with this extra call became very similar to\n__xe_exec_queue_fini(), reuse that. To make this reuse possible,\nalter xe_lrc_put() so it can survive NULL parameters, like other\nsimilar functions.\n\nv2: Reuse _xe_exec_queue_fini(). Make xe_lrc_put() aware of NULLs.\n\n(cherry picked from commit 393e5fea6f7d7054abc2c3d97a4cfe8306cd6079)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe/queue: Llamar a fini al fallar la creaci\u00f3n de la cola de ejecuci\u00f3n\n\nCada llamada a init de cola deber\u00eda tener una llamada a fini correspondiente. Omitir esto significar\u00eda omitir la eliminaci\u00f3n de la cola de la lista GuC (lo cual es parte de la asignaci\u00f3n de guc_id). Una cola da\u00f1ada almacenada en la lista exec_queue_lookup conducir\u00eda a una referencia de memoria inv\u00e1lida, tarde o temprano.\n\nLlamar a fini para liberar guc_id. Esto debe hacerse antes de que se liberen cualesquiera LRCs internos.\n\nDado que la finalizaci\u00f3n con esta llamada extra se volvi\u00f3 muy similar a __xe_exec_queue_fini(), reutilizar eso. Para hacer posible esta reutilizaci\u00f3n, modificar xe_lrc_put() para que pueda sobrevivir a par\u00e1metros NULL, como otras funciones similares.\n\nv2: Reutilizar _xe_exec_queue_fini(). Hacer que xe_lrc_put() sea consciente de los NULLs.\n\n(extra\u00eddo de la confirmaci\u00f3n 393e5fea6f7d7054abc2c3d97a4cfe8306cd6079)"}], "id": "CVE-2026-23350", "lastModified": "2026-06-17T10:21:24.473", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-03-25T11:16:33.320", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/99f9b5343cae80eb0dfe050baf6c86d722b3ba2e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fae65b8a4449ae556990efcde8d74bec4adc5925"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/xe/queue: Call fini on exec queue creation fail", "id": "2451166", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451166"}, "csaw": false, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel. When an execution queue fails to initialize in the `drm/xe/queue` component, the system does not properly finalize it, leaving a damaged entry in a critical lookup list. This can lead to an invalid memory reference, potentially causing system instability or a denial of service (DoS)."], "name": "CVE-2026-23350", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23350\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23350\nhttps://lore.kernel.org/linux-cve-announce/2026032536-CVE-2026-23350-f4be@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c1fa4aa60b146d1fa73b2b87064303f8e4b7952,fae65b8a4449ae556990efcde8d74bec4adc5925)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c1fa4aa60b146d1fa73b2b87064303f8e4b7952,99f9b5343cae80eb0dfe050baf6c86d722b3ba2e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T17:07:51.691188+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a release that includes the patch fixing the missing fini call in the DRM Xe queue code. If a kernel upgrade is not immediately possible, verify that the graphics driver and DRM implementation are up to date and consider disabling Xe queue functionality until a fix is applied. Monitor system logs for any abnormal DRM or kernel messages that could indicate lingering queue handling issues.", "If an immediate kernel update is not available, prevent the affected driver from loading by blacklisting or unloading the Xe-related modules, and consider disabling Xe queue features via module parameters until the fix is deployed.", "Subscribe to the Linux kernel security mailing lists or vendor advisories to receive notifications of any new patches or workaround releases for this vulnerability."], "summary": {"action": "Immediate Patch", "impact": "Privileged escalation via kernel memory corruption"}, "threat_synthesis": {"affected_systems": "The defect is present in the Linux kernel\u2019s DRM Xe module. No specific kernel release numbers are listed, so any Linux kernel build that includes the xe/queue code without the required fini call is potentially affected. Systems running kernel versions prior to the patch commit are at risk.", "description_and_impact": "The vulnerability occurs in the Linux kernel DRM Xe queue initialization path where a missing finalization call causes a dangling queue reference that is later dereferenced during lookup. This results in an invalid memory reference that can lead to kernel memory corruption, potentially enabling an attacker with local access to trigger privilege escalation or a denial\u2011of\u2011service by crashing the system. The weakness correlates with CWE\u2011772 \u2013 missing release of resource, and CWE\u2011401 \u2013 unreleased resource.", "risk_and_exploitability": "The CVSS score of 7.8 signals high severity, but the EPSS score of less than 1% indicates that exploitation is currently unlikely. The vulnerability is not listed in CISA\u2019s KEV catalog. The attack is most likely local, targeting the graphics subsystem; a local attacker could trigger the fault and achieve privilege escalation or a crash, although no public exploits have been reported yet."}}}}, "created": "2026-03-25T21:32:05.055133+00:00", "updated": "2026-04-28T17:15:21.244467+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}