CVE-2026-52950drm/xe/dma-buf: fix UAF with retry loop
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: fix UAF with retry loop Retry doesn't work here, since bo will be freed on error, leading to UAF. However, now that we do the alloc & init before the attach, we can now combine this as one unit and have the init do the alloc for us. This should make the retry safe. Reported by Sashiko. v2: Fix up the error unwind (CI) (cherry picked from commit 479669418253e0f27f8cf5db01a731352ea592e7)
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-825
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 before 39fdac6be02eb7c3460518c1c4085f75f935c4ce; from eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 before 827062952ed9bdf4220466c1f05ce452d04bdedf; from eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 before 155a372a1cc50fa93387c5d3cdfd614a61e1afd1 | CNA record |
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | from 0:6.12.0-211.37.1.el10_2 not affected | CISA ADP |
linux linux_kernel linux:linux_kernel | from 6.18 before 6.18.33; from 6.19 before 7.0.10; 7.1; 7.1; 7.1 | NVD |
References
- https://git.kernel.org/stable/c/39fdac6be02eb7c3460518c1c4085f75f935c4cepatch
- https://git.kernel.org/stable/c/827062952ed9bdf4220466c1f05ce452d04bdedfpatch
- https://git.kernel.org/stable/c/155a372a1cc50fa93387c5d3cdfd614a61e1afd1patch
- https://access.redhat.com/errata/RHSA-2026:42919
- https://access.redhat.com/errata/RHSA-2026:45192
- https://access.redhat.com/security/cve/CVE-2026-52950third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2492318third-party-advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52950.jsonthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.