CVE-2026-46264

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46264", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.108Z", "datePublished": "2026-06-03T15:50:04.620Z", "dateUpdated": "2026-08-05T12:30:51.365Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:30:51.365Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Fix sysfs initialization\n\nIn case of devm_add_action_or_reset() failure the provided cleanup\naction will be run immediately on the not yet initialized kobject.\nThis may lead to errors like:\n\n [ ] kobject: '(null)' (ff110001393608e0): is not initialized, yet kobject_put() is being called.\n [ ] WARNING: lib/kobject.c:734 at kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:kobject_put+0xdf/0x250\n [ ] Call Trace:\n [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ] xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ] xe_device_probe+0x5f2/0xc20 [xe]\n [ ] xe_pci_probe+0x396/0x610 [xe]\n [ ] local_pci_probe+0x47/0xb0\n\n [ ] refcount_t: underflow; use-after-free.\n [ ] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0\n [ ] Call Trace:\n [ ] kobject_put+0x174/0x250\n [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ] xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ] xe_device_probe+0x5f2/0xc20 [xe]\n [ ] xe_pci_probe+0x396/0x610 [xe]\n [ ] local_pci_probe+0x47/0xb0\n\nFix that by calling kobject_init() and kobject_add() separately\nand register cleanup action after the kobject is initialized.\n\nAlso make this cleanup registration a part of the create helper to\nfix another mistake, as in the loop we were wrongly passing parent\nkobject while registering cleanup action, and this resulted in some\nundetected leaks.\n\n(cherry picked from commit 98b16727f07e26a5d4de84d88805ce7ffcfdd324)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only from the local PCI/driver probe path (xe_pci_probe \u2192 xe_device_probe \u2192 xe_sriov_pf_sysfs_init), not from any network protocol handler.\nAC:L - Triggering devm_add_action_or_reset failure is primarily ENOMEM from devres allocation, which an attacker can influence with sustained memory pressure; no rare layout or victim-state race is required beyond that.\nPR:L - No capability beyond a local login is needed to pressure the kernel into ENOMEM during probe on shared hosts; reaching the SR-IOV PF sysfs init path does not require init-namespace root if the Xe PF is already probing (boot, hotplug, or admin rebind).\nUI:N - Exploitation does not depend on a victim opening files or clicking anything; it occurs during automatic driver probe when the failure path runs.\nS:C - The flaw runs in the SR-IOV PF host driver that administers VF isolation; host kernel memory corruption during PF sysfs setup can break the virtualization boundary and impact tenant VFs on cloud/datacenter GPU hosts.\nC:H - Calling kobject_put() on an uninitialized kobject drives refcount underflow on uninitialized kref state, which the fix commit and kernel warnings classify as use-after-free with potential for arbitrary read primitives.\nI:H - The same uninitialized kobject_put()/refcount corruption can corrupt kernel heap metadata and be developed into arbitrary write or code execution, consistent with UAF-class impact.\nA:H - The observed failure mode includes kernel WARN/oops on kobject_put, refcount underflow warnings, and probe/setup failure that can deny GPU/SR-IOV availability on the host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_sriov_pf_sysfs.c"], "versions": [{"version": "5c170a4d9c530e872f2f788d95258fbaa39b4415", "lessThan": "6ae479b1919ee9bd0560fc7af649932dd420d010", "status": "affected", "versionType": "git"}, {"version": "5c170a4d9c530e872f2f788d95258fbaa39b4415", "lessThan": "bf7172cd25ed182f30af2cbb9f80c730dc717d8e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_sriov_pf_sysfs.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.4", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6ae479b1919ee9bd0560fc7af649932dd420d010"}, {"url": "https://git.kernel.org/stable/c/bf7172cd25ed182f30af2cbb9f80c730dc717d8e"}], "title": "drm/xe/pf: Fix sysfs initialization", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_sriov_pf_sysfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6ae479b1919ee9bd0560fc7af649932dd420d010", "status": "affected", "version": "5c170a4d9c530e872f2f788d95258fbaa39b4415", "versionType": "git"}, {"lessThan": "bf7172cd25ed182f30af2cbb9f80c730dc717d8e", "status": "affected", "version": "5c170a4d9c530e872f2f788d95258fbaa39b4415", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_sriov_pf_sysfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092", "versionEndExcluding": "6.19.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Fix sysfs initialization\n\nIn case of devm_add_action_or_reset() failure the provided cleanup\naction will be run immediately on the not yet initialized kobject.\nThis may lead to errors like:\n\n [ ] kobject: '(null)' (ff110001393608e0): is not initialized, yet kobject_put() is being called.\n [ ] WARNING: lib/kobject.c:734 at kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:kobject_put+0xdf/0x250\n [ ] Call Trace:\n [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ] xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ] xe_device_probe+0x5f2/0xc20 [xe]\n [ ] xe_pci_probe+0x396/0x610 [xe]\n [ ] local_pci_probe+0x47/0xb0\n\n [ ] refcount_t: underflow; use-after-free.\n [ ] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0\n [ ] Call Trace:\n [ ] kobject_put+0x174/0x250\n [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ] xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ] xe_device_probe+0x5f2/0xc20 [xe]\n [ ] xe_pci_probe+0x396/0x610 [xe]\n [ ] local_pci_probe+0x47/0xb0\n\nFix that by calling kobject_init() and kobject_add() separately\nand register cleanup action after the kobject is initialized.\n\nAlso make this cleanup registration a part of the create helper to\nfix another mistake, as in the loop we were wrongly passing parent\nkobject while registering cleanup action, and this resulted in some\nundetected leaks.\n\n(cherry picked from commit 98b16727f07e26a5d4de84d88805ce7ffcfdd324)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe/pf: Correcci\u00f3n de la inicializaci\u00f3n de sysfs\n\nEn caso de fallo de devm_add_action_or_reset(), la acci\u00f3n de limpieza proporcionada se ejecutar\u00e1 inmediatamente en el kobject a\u00fan no inicializado. Esto puede provocar errores como:\n\n [ ] kobject: '(null)' (ff110001393608e0): no est\u00e1 inicializado, sin embargo, se est\u00e1 llamando a kobject_put().\n [ ] ADVERTENCIA: lib/kobject.c:734 en kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:kobject_put+0xdf/0x250\n [ ] Call Trace:\n [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ] xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ] xe_device_probe+0x5f2/0xc20 [xe]\n [ ] xe_pci_probe+0x396/0x610 [xe]\n [ ] local_pci_probe+0x47/0xb0\n\n [ ] refcount_t: desbordamiento negativo; uso despu\u00e9s de liberaci\u00f3n.\n [ ] ADVERTENCIA: lib/refcount.c:28 en refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0\n [ ] Call Trace:\n [ ] kobject_put+0x174/0x250\n [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ] xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ] xe_device_probe+0x5f2/0xc20 [xe]\n [ ] xe_pci_probe+0x396/0x610 [xe]\n [ ] local_pci_probe+0x47/0xb0\n\nEsto se soluciona llamando a kobject_init() y kobject_add() por separado y registrando la acci\u00f3n de limpieza despu\u00e9s de que el kobject est\u00e9 inicializado.\n\nTambi\u00e9n se hace que este registro de limpieza sea parte del asistente de creaci\u00f3n para corregir otro error, ya que en el bucle est\u00e1bamos pasando incorrectamente el kobject padre al registrar la acci\u00f3n de limpieza, y esto result\u00f3 en algunas fugas no detectadas.\n\n(seleccionado de la confirmaci\u00f3n 98b16727f07e26a5d4de84d88805ce7ffcfdd324)"}], "id": "CVE-2026-46264", "lastModified": "2026-07-22T20:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-06-03T18:16:27.893", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6ae479b1919ee9bd0560fc7af649932dd420d010"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bf7172cd25ed182f30af2cbb9f80c730dc717d8e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/xe/pf: Fix sysfs initialization", "id": "2484464", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484464"}, "csaw": false, "cwe": "CWE-824", "details": ["A flaw was found in the Linux kernel's drm/xe/pf component. This vulnerability arises during the initialization of the sysfs interface, where an error in `devm_add_action_or_reset()` can cause a cleanup action to execute on an uninitialized kernel object. This can lead to a use-after-free condition, which may allow a local attacker to cause a system crash (Denial of Service) or potentially escalate their privileges."], "name": "CVE-2026-46264", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46264\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46264\nhttps://lore.kernel.org/linux-cve-announce/2026060337-CVE-2026-46264-a91c@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5c170a4d9c530e872f2f788d95258fbaa39b4415,6ae479b1919ee9bd0560fc7af649932dd420d010)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5c170a4d9c530e872f2f788d95258fbaa39b4415,bf7172cd25ed182f30af2cbb9f80c730dc717d8e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.4,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-03T18:45:40.186667+00:00", "updated": "2026-06-09T20:15:07.096779+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}