CVE-2026-72361

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hw_engine: Fix double-free of managed BO in error path The error path in hw_engine_init() explicitly frees a BO allocated with xe_managed_bo_create_pin_map() via xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm cleanup action registered, this causes a double-free when devm unwinds during probe failure. Remove the explicit free and let devm handle it, consistent with all other xe_managed_bo_create_pin_map() callers. (cherry picked from commit e459a3bdeb117be496d7f229e2ea1f6c9fe4080b)

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/1f6b44d555ecce61e249220f2ca4d75cdb90caf6
https://git.kernel.org/stable/c/23ee91355e31947595b86ebb9ef4664f20fd926d
https://git.kernel.org/stable/c/7ac3cae7a251d28e9079de07a991bd4eb2bb7fd8
https://git.kernel.org/stable/c/a0a56b4480a0dc921a42cd70e9fc081a12ab8359

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-15 06:22

Updated : 2026-08-17 06:18

NVD link : CVE-2026-72361

Mitre link : CVE-2026-72361

CVE.ORG link : CVE-2026-72361

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-72361", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0e1a47fcabc8ffa6f460c60c2caa04e51170fa22", "lessThan": "1f6b44d555ecce61e249220f2ca4d75cdb90caf6", "versionType": "git"}, {"status": "affected", "version": "0e1a47fcabc8ffa6f460c60c2caa04e51170fa22", "lessThan": "a0a56b4480a0dc921a42cd70e9fc081a12ab8359", "versionType": "git"}, {"status": "affected", "version": "0e1a47fcabc8ffa6f460c60c2caa04e51170fa22", "lessThan": "23ee91355e31947595b86ebb9ef4664f20fd926d", "versionType": "git"}, {"status": "affected", "version": "0e1a47fcabc8ffa6f460c60c2caa04e51170fa22", "lessThan": "7ac3cae7a251d28e9079de07a991bd4eb2bb7fd8", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/xe/xe_hw_engine.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/xe/xe_hw_engine.c"], "defaultStatus": "affected"}]}], "published": "2026-08-15T06:22:09.530", "references": [{"url": "https://git.kernel.org/stable/c/1f6b44d555ecce61e249220f2ca4d75cdb90caf6", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/23ee91355e31947595b86ebb9ef4664f20fd926d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7ac3cae7a251d28e9079de07a991bd4eb2bb7fd8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a0a56b4480a0dc921a42cd70e9fc081a12ab8359", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/hw_engine: Fix double-free of managed BO in error path\n\nThe error path in hw_engine_init() explicitly frees a BO allocated\nwith xe_managed_bo_create_pin_map() via xe_bo_unpin_map_no_vm().\nSince the managed BO already has a devm cleanup action registered,\nthis causes a double-free when devm unwinds during probe failure.\n\nRemove the explicit free and let devm handle it, consistent with\nall other xe_managed_bo_create_pin_map() callers.\n\n(cherry picked from commit e459a3bdeb117be496d7f229e2ea1f6c9fe4080b)"}], "lastModified": "2026-08-17T06:18:40.313", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}