CVE-2026-72311drm/xe: free madvise VMA array on L2 flush failure
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/xe: free madvise VMA array on L2 flush failure xe_vm_madvise_ioctl() allocates madvise_range.vmas in get_vmas(). After get_vmas() succeeds with at least one VMA, error paths must go through free_vmas so the array is released before the madvise details are destroyed. The L2 flush validation path added for PAT madvise rejects some SVM/userptr ranges after get_vmas() has succeeded, but jumps directly to madv_fini. This skips kfree(madvise_range.vmas), leaking the VMA array on each failed ioctl. Jump to free_vmas instead, matching the other validation failure paths after get_vmas() has succeeded. (cherry picked from commit c3a1c3579b1250060da73507a4acef712974c78a)
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4f39a194d41e6b8cb61a91a7bb01b17be59a7d73 before bf126747e7bff55e5ba0b1ec10fc5fce99feaed9; from 4f39a194d41e6b8cb61a91a7bb01b17be59a7d73 before 14abbed336a2d1bbd726c25d148d2ec0ff928073 | CNA record |
References
- https://git.kernel.org/stable/c/bf126747e7bff55e5ba0b1ec10fc5fce99feaed9
- https://git.kernel.org/stable/c/14abbed336a2d1bbd726c25d148d2ec0ff928073
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.