GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23350 (GCVE-0-2026-23350)

Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-08-05 12:21
VLAI
Title
drm/xe/queue: Call fini on exec queue creation fail
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/queue: Call fini on exec queue creation fail Every call to queue init should have a corresponding fini call. Skipping this would mean skipping removal of the queue from GuC list (which is part of guc_id allocation). A damaged queue stored in exec_queue_lookup list would lead to invalid memory reference, sooner or later. Call fini to free guc_id. This must be done before any internal LRCs are freed. Since the finalization with this extra call became very similar to __xe_exec_queue_fini(), reuse that. To make this reuse possible, alter xe_lrc_put() so it can survive NULL parameters, like other similar functions. v2: Reuse _xe_exec_queue_fini(). Make xe_lrc_put() aware of NULLs. (cherry picked from commit 393e5fea6f7d7054abc2c3d97a4cfe8306cd6079)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3c1fa4aa60b146d1fa73b2b87064303f8e4b7952 , < fae65b8a4449ae556990efcde8d74bec4adc5925 (git)
Affected: 3c1fa4aa60b146d1fa73b2b87064303f8e4b7952 , < 99f9b5343cae80eb0dfe050baf6c86d722b3ba2e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 6.19.7 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_exec_queue.c",
            "drivers/gpu/drm/xe/xe_lrc.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fae65b8a4449ae556990efcde8d74bec4adc5925",
              "status": "affected",
              "version": "3c1fa4aa60b146d1fa73b2b87064303f8e4b7952",
              "versionType": "git"
            },
            {
              "lessThan": "99f9b5343cae80eb0dfe050baf6c86d722b3ba2e",
              "status": "affected",
              "version": "3c1fa4aa60b146d1fa73b2b87064303f8e4b7952",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_exec_queue.c",
            "drivers/gpu/drm/xe/xe_lrc.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.7",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/queue: Call fini on exec queue creation fail\n\nEvery call to queue init should have a corresponding fini call.\nSkipping this would mean skipping removal of the queue from GuC list\n(which is part of guc_id allocation). A damaged queue stored in\nexec_queue_lookup list would lead to invalid memory reference,\nsooner or later.\n\nCall fini to free guc_id. This must be done before any internal\nLRCs are freed.\n\nSince the finalization with this extra call became very similar to\n__xe_exec_queue_fini(), reuse that. To make this reuse possible,\nalter xe_lrc_put() so it can survive NULL parameters, like other\nsimilar functions.\n\nv2: Reuse _xe_exec_queue_fini(). Make xe_lrc_put() aware of NULLs.\n\n(cherry picked from commit 393e5fea6f7d7054abc2c3d97a4cfe8306cd6079)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached via the DRM_IOCTL_XE_EXEC_QUEUE_CREATE ioctl on the Intel Xe GPU render node (/dev/dri/renderD*), which requires local system access.\nAC:L - The attacker can trigger xe_lrc_create() failure through memory pressure (controllable by a local user) or by using a width \u003e 1 to increase allocation failure probability. No race condition or uncontrollable preconditions are required.\nPR:L - The ioctl is DRM_RENDER_ALLOW, accessible to any unprivileged user who can open the render node device file, which is typically world-accessible on systems with Intel GPUs.\nUI:N - No user interaction is needed; the attacker directly invokes the ioctl.\nS:U - The vulnerability affects the kernel within its own security authority; there is no VM escape or sandbox boundary crossing.\nC:H - This is a use-after-free where the freed queue object remains in the exec_queue_lookup xarray. An attacker can reclaim the freed slab with controlled data, enabling arbitrary kernel memory reads through the stale pointer.\nI:H - The use-after-free allows heap spraying to control the freed object\u0027s contents, enabling arbitrary write primitives and potential code execution when the GuC submission code operates on the stale queue pointer.\nA:H - Accessing the freed queue through the dangling pointer in exec_queue_lookup will cause invalid memory references, leading to kernel crashes or panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:21:15.714Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fae65b8a4449ae556990efcde8d74bec4adc5925"
        },
        {
          "url": "https://git.kernel.org/stable/c/99f9b5343cae80eb0dfe050baf6c86d722b3ba2e"
        }
      ],
      "title": "drm/xe/queue: Call fini on exec queue creation fail",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23350",
    "datePublished": "2026-03-25T10:27:36.182Z",
    "dateReserved": "2026-01-13T15:37:45.999Z",
    "dateUpdated": "2026-08-05T12:21:15.714Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23350",
      "date": "2026-09-15",
      "epss": "0.00129",
      "percentile": "0.02933"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23350\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-03-25T11:16:33.320\",\"lastModified\":\"2026-06-17T10:21:24.473\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe/queue: Call fini on exec queue creation fail\\n\\nEvery call to queue init should have a corresponding fini call.\\nSkipping this would mean skipping removal of the queue from GuC list\\n(which is part of guc_id allocation). A damaged queue stored in\\nexec_queue_lookup list would lead to invalid memory reference,\\nsooner or later.\\n\\nCall fini to free guc_id. This must be done before any internal\\nLRCs are freed.\\n\\nSince the finalization with this extra call became very similar to\\n__xe_exec_queue_fini(), reuse that. To make this reuse possible,\\nalter xe_lrc_put() so it can survive NULL parameters, like other\\nsimilar functions.\\n\\nv2: Reuse _xe_exec_queue_fini(). Make xe_lrc_put() aware of NULLs.\\n\\n(cherry picked from commit 393e5fea6f7d7054abc2c3d97a4cfe8306cd6079)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\ndrm/xe/queue: Llamar a fini al fallar la creaci\u00f3n de la cola de ejecuci\u00f3n\\n\\nCada llamada a init de cola deber\u00eda tener una llamada a fini correspondiente. Omitir esto significar\u00eda omitir la eliminaci\u00f3n de la cola de la lista GuC (lo cual es parte de la asignaci\u00f3n de guc_id). Una cola da\u00f1ada almacenada en la lista exec_queue_lookup conducir\u00eda a una referencia de memoria inv\u00e1lida, tarde o temprano.\\n\\nLlamar a fini para liberar guc_id. Esto debe hacerse antes de que se liberen cualesquiera LRCs internos.\\n\\nDado que la finalizaci\u00f3n con esta llamada extra se volvi\u00f3 muy similar a __xe_exec_queue_fini(), reutilizar eso. Para hacer posible esta reutilizaci\u00f3n, modificar xe_lrc_put() para que pueda sobrevivir a par\u00e1metros NULL, como otras funciones similares.\\n\\nv2: Reutilizar _xe_exec_queue_fini(). Hacer que xe_lrc_put() sea consciente de los NULLs.\\n\\n(extra\u00eddo de la confirmaci\u00f3n 393e5fea6f7d7054abc2c3d97a4cfe8306cd6079)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_exec_queue.c\",\"drivers/gpu/drm/xe/xe_lrc.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3c1fa4aa60b146d1fa73b2b87064303f8e4b7952\",\"lessThan\":\"fae65b8a4449ae556990efcde8d74bec4adc5925\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c1fa4aa60b146d1fa73b2b87064303f8e4b7952\",\"lessThan\":\"99f9b5343cae80eb0dfe050baf6c86d722b3ba2e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_exec_queue.c\",\"drivers/gpu/drm/xe/xe_lrc.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.7\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19.1\",\"versionEndExcluding\":\"6.19.7\",\"matchCriteriaId\":\"8ACF56ED-6FE0-41DE-BECE-41134CC7BD44\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"35C8A871-4971-433E-A046-FC9F7B7D190A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/99f9b5343cae80eb0dfe050baf6c86d722b3ba2e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fae65b8a4449ae556990efcde8d74bec4adc5925\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-29T20:57:17+00:00",
      "cve": "CVE-2026-23350",
      "id": "CVE-2026-23350",
      "initial_release_date": "2026-03-25T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/xe/queue: Call fini on exec queue creation fail",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23350.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:26:15Z",
      "cve": "CVE-2026-23350",
      "id": "CVE-2026-23350",
      "initial_release_date": "2026-03-25T16:55:47Z",
      "product_status:known_not_affected": "332",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23350",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23350.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.