In the Linux kernel, the following vulnerability has been resolved:
drm/xe/oa: Fix exec_queue leak on width check in stream open
In xe_oa_stream_open_ioctl(), when param.exec_q->width > 1 the
function returns -EOPNOTSUPP directly, skipping the existing
err_exec_q cleanup path. The exec_queue reference obtained by
xe_exec_queue_lookup() is leaked.
The exec queue holds a reference on the xe_file, which is only
dropped during queue teardown. The leaked lookup ref is not on
the file's exec_queue xarray, so file close cannot release it.
This keeps both the exec queue and the file private state pinned
indefinitely.
Jump to err_exec_q instead of returning directly so the reference
is released.
(cherry picked from commit 339fa0be9e4a5d69fa47e91f4a36574224fb478f)
References
Configurations
Configuration 1 (hide)
|
History
13 Oct 2026, 14:55
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | () https://git.kernel.org/stable/c/04ef7592eaadd9ca8f8f66e76452f73525cff819 - Patch | |
| References | () https://git.kernel.org/stable/c/4b0c4f0c1b133d4bfa31c167200bcda646873328 - Patch | |
| References | () https://git.kernel.org/stable/c/4d25342543c01310fc4e0cba7cb17c775e2421e2 - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
|
| First Time |
Linux
Linux linux Kernel |
|
| CWE | CWE-401 |
Information
Published : 2026-07-19 16:17
Updated : 2026-10-13 14:55
NVD link : CVE-2026-64021
Mitre link : CVE-2026-64021
CVE.ORG link : CVE-2026-64021
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-401
Missing Release of Memory after Effective Lifetime