CVE-2026-23421

Vulnerability

Description

In the Linux kernel's drm/xe/configfs driver, a memory leak exists where memory allocated for ctx_restore_mid_bb in wa_bb_store() is not properly freed. The xe_config_device_release() function only frees ctx_restore_post_bb, omitting the corresponding cleanup for ctx_restore_mid_bb[0].cs. This inconsistency results in a leakage of allocated memory when a configfs device is removed [1][2][3].

Attack

Vector and Prerequisites

Exploitation requires the ability to interact with the configfs interface for the Xe DRM driver, enabling allocation of the ctx_restore_mid_bb buffer followed by removal of the configfs device. Local access with sufficient privileges to manage configfs entries is necessary. The vulnerability is present in kernel versions that include the affected code before the fix [1][2][3].

Impact

An attacker who repeatedly creates and removes configfs devices can exhaust kernel memory, leading to denial-of-service conditions. The leak is incremental per device removal, and no other security implications (such as code execution or privilege escalation) have been identified from this bug [1][2][3].

Mitigation

The issue is patched in the Linux kernel stable tree. Users should update to a kernel version containing the commit that adds the missing free call for ctx_restore_mid_bb[0].cs. No workarounds have been documented; applying the kernel update is the recommended mitigation [1][2][3].