High severity7.8NVD Advisory· Published Jun 24, 2026· Updated Jul 27, 2026

CVE-2026-52950

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/dma-buf: fix UAF with retry loop

Retry doesn't work here, since bo will be freed on error, leading to UAF. However, now that we do the alloc & init before the attach, we can now combine this as one unit and have the init do the alloc for us. This should make the retry safe.

Reported by Sashiko.

v2: Fix up the error unwind (CI)

(cherry picked from commit 479669418253e0f27f8cf5db01a731352ea592e7)

Affected products

Linux/Kernel5 versions
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=6.18,<6.18.33
- cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
- (no CPE)
osv-coords76 versions
pkg:linux/kernel pkg:rpm/almalinux/kernel pkg:rpm/almalinux/kernel-64k pkg:rpm/almalinux/kernel-64k-core pkg:rpm/almalinux/kernel-64k-debug pkg:rpm/almalinux/kernel-64k-debug-core pkg:rpm/almalinux/kernel-64k-debug-devel pkg:rpm/almalinux/kernel-64k-debug-devel-matched pkg:rpm/almalinux/kernel-64k-debug-modules pkg:rpm/almalinux/kernel-64k-debug-modules-core pkg:rpm/almalinux/kernel-64k-debug-modules-extra pkg:rpm/almalinux/kernel-64k-devel pkg:rpm/almalinux/kernel-64k-devel-matched pkg:rpm/almalinux/kernel-64k-modules pkg:rpm/almalinux/kernel-64k-modules-core pkg:rpm/almalinux/kernel-64k-modules-extra pkg:rpm/almalinux/kernel-abi-stablelists pkg:rpm/almalinux/kernel-core pkg:rpm/almalinux/kernel-cross-headers pkg:rpm/almalinux/kernel-debug pkg:rpm/almalinux/kernel-debug-core pkg:rpm/almalinux/kernel-debug-devel pkg:rpm/almalinux/kernel-debug-devel-matched pkg:rpm/almalinux/kernel-debug-modules pkg:rpm/almalinux/kernel-debug-modules-core pkg:rpm/almalinux/kernel-debug-modules-extra pkg:rpm/almalinux/kernel-debug-uki-virt pkg:rpm/almalinux/kernel-devel pkg:rpm/almalinux/kernel-devel-matched pkg:rpm/almalinux/kernel-doc pkg:rpm/almalinux/kernel-headers pkg:rpm/almalinux/kernel-modules pkg:rpm/almalinux/kernel-modules-core pkg:rpm/almalinux/kernel-modules-extra pkg:rpm/almalinux/kernel-modules-extra-matched pkg:rpm/almalinux/kernel-rt pkg:rpm/almalinux/kernel-rt-64k pkg:rpm/almalinux/kernel-rt-64k-core pkg:rpm/almalinux/kernel-rt-64k-debug pkg:rpm/almalinux/kernel-rt-64k-debug-core pkg:rpm/almalinux/kernel-rt-64k-debug-devel pkg:rpm/almalinux/kernel-rt-64k-debug-modules pkg:rpm/almalinux/kernel-rt-64k-debug-modules-core pkg:rpm/almalinux/kernel-rt-64k-debug-modules-extra pkg:rpm/almalinux/kernel-rt-64k-devel pkg:rpm/almalinux/kernel-rt-64k-modules pkg:rpm/almalinux/kernel-rt-64k-modules-core pkg:rpm/almalinux/kernel-rt-64k-modules-extra pkg:rpm/almalinux/kernel-rt-core pkg:rpm/almalinux/kernel-rt-debug pkg:rpm/almalinux/kernel-rt-debug-core pkg:rpm/almalinux/kernel-rt-debug-devel pkg:rpm/almalinux/kernel-rt-debug-modules pkg:rpm/almalinux/kernel-rt-debug-modules-core pkg:rpm/almalinux/kernel-rt-debug-modules-extra pkg:rpm/almalinux/kernel-rt-devel pkg:rpm/almalinux/kernel-rt-modules pkg:rpm/almalinux/kernel-rt-modules-core pkg:rpm/almalinux/kernel-rt-modules-extra pkg:rpm/almalinux/kernel-tools pkg:rpm/almalinux/kernel-tools-libs pkg:rpm/almalinux/kernel-tools-libs-devel pkg:rpm/almalinux/kernel-uki-virt pkg:rpm/almalinux/kernel-uki-virt-addons pkg:rpm/almalinux/kernel-zfcpdump pkg:rpm/almalinux/kernel-zfcpdump-core pkg:rpm/almalinux/kernel-zfcpdump-devel pkg:rpm/almalinux/kernel-zfcpdump-devel-matched pkg:rpm/almalinux/kernel-zfcpdump-modules pkg:rpm/almalinux/kernel-zfcpdump-modules-core pkg:rpm/almalinux/kernel-zfcpdump-modules-extra pkg:rpm/almalinux/libperf pkg:rpm/almalinux/perf pkg:rpm/almalinux/python3-perf pkg:rpm/almalinux/rtla pkg:rpm/almalinux/rv
>= 6.18.0, < 6.18.33+ 75 more
- (no CPE)range: >= 6.18.0, < 6.18.33
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2
- (no CPE)range: < 6.12.0-211.37.1.el10_2

Patches

Vulnerability mechanics

References

git.kernel.org/stable/c/155a372a1cc50fa93387c5d3cdfd614a61e1afd1nvdPatch
git.kernel.org/stable/c/39fdac6be02eb7c3460518c1c4085f75f935c4cenvdPatch
git.kernel.org/stable/c/827062952ed9bdf4220466c1f05ce452d04bdedfnvdPatch
access.redhat.com/security/cve/CVE-2026-52950nvdThird Party Advisory
bugzilla.redhat.com/show_bug.cginvdThird Party Advisory
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52950.jsonnvdThird Party Advisory
access.redhat.com/errata/RHSA-2026:42919nvd
access.redhat.com/errata/RHSA-2026:45192nvd

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000