CVE-2026-72361drm/xe/hw_engine: Fix double-free of managed BO in error path
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/xe/hw_engine: Fix double-free of managed BO in error path The error path in hw_engine_init() explicitly frees a BO allocated with xe_managed_bo_create_pin_map() via xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm cleanup action registered, this causes a double-free when devm unwinds during probe failure. Remove the explicit free and let devm handle it, consistent with all other xe_managed_bo_create_pin_map() callers. (cherry picked from commit e459a3bdeb117be496d7f229e2ea1f6c9fe4080b)
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0e1a47fcabc8ffa6f460c60c2caa04e51170fa22 before 1f6b44d555ecce61e249220f2ca4d75cdb90caf6; from 0e1a47fcabc8ffa6f460c60c2caa04e51170fa22 before a0a56b4480a0dc921a42cd70e9fc081a12ab8359; from 0e1a47fcabc8ffa6f460c60c2caa04e51170fa22 before 23ee91355e31947595b86ebb9ef4664f20fd926d; from 0e1a47fcabc8ffa6f460c60c2caa04e51170fa22 before 7ac3cae7a251d28e9079de07a991bd4eb2bb7fd8 | CNA record |
References
- https://git.kernel.org/stable/c/1f6b44d555ecce61e249220f2ca4d75cdb90caf6
- https://git.kernel.org/stable/c/a0a56b4480a0dc921a42cd70e9fc081a12ab8359
- https://git.kernel.org/stable/c/23ee91355e31947595b86ebb9ef4664f20fd926d
- https://git.kernel.org/stable/c/7ac3cae7a251d28e9079de07a991bd4eb2bb7fd8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.