From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AF6B131280D for ; Wed, 24 Jun 2026 16:34:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782318859; cv=none; b=hpNO5zS7VmM3pyGb+M3gqIaq3N0Um8kW+iJ/hSDOBkkpi0+Y9mjLq3fp2+O2BMEKKk4ET7DqejXR1EsHJasaXacZpV0TaIbnwMDGomaiFSiihwYDSceXcZ9ouF1fC68lpm//kXTJkZuKHfHAMkvF53uO6D6LuYXNzrsDBmqWR4E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782318859; c=relaxed/simple; bh=BhfMVGdf4SHxELw6gdJAd03tnS1ROHg1TczORxx5zcI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=gPSmmE8sTsc5+V++naRTgYysf4qGfRSJXs04ZRi04FbF8vELbKhXBgj8ZexA70q29GV5cl6iwDSwHlcwSxMn7Cggs5tmR2XwUKaeNU5oRRnvOxBf/3O7A1ys8GrFGSVMwmFV7hfsEKmXGnrULBktZfHUKbYBCIe8ucsR4BglLiE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KgCJ5AUh; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="KgCJ5AUh" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 017F11F00A3A; Wed, 24 Jun 2026 16:34:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1782318858; bh=p3BwmDrv+liNMiFOv6N2zSxL/jVHrVtjmjSMvpDonJA=; h=From:To:Cc:Subject:Date:Reply-To; b=KgCJ5AUhgzWoWEv1TSX/oaGP5ITrWQVMEerwIOw5hcNKknRPW7/b8mwF7XBYHBqqP BQxyn4Gu2bMBJNJGffE0j6PZci4DPaf7L9msK+fJ76M9kJ+48qxK5ts9Nn0PBvsu66 CcuI8RcPyRrUQglF/QMLllwmqAlBV8QH/tXlugCM= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-52976: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() Date: Wed, 24 Jun 2026 17:30:00 +0100 Message-ID: <2026062440-CVE-2026-52976-d615@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3459; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=rjjgL/18ZUgxEdOhJ/c/jaTKUdo+x7GNG2mqgVWehD0=; b=owGbwMvMwCRo6H6F97bub03G02pJDFk2rF9yTSfzuPXNn3dF8sLeiokSRX8Pztu2fpqEtswk2 1aZBy16HbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjAR3g8M8xP2V7u+7kicsbw6 rno/47vCQxMXWDDMj5uof04x9PI5L6MJjU82/FuQolxjCwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() Two error handling issues exist in xe_exec_queue_create_ioctl(): 1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in preempt fence mode, xe_vm_add_compute_exec_queue() has already added the queue to the VM's compute exec queue list. Skipping the kill leaves the queue on that list, leading to a dangling pointer after the queue is freed. 2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has succeeded, the error path does not call xe_hw_engine_group_del_exec_queue() to remove the queue from the hw engine group list. The queue is then freed while still linked into the hw engine group, causing a use-after-free. Fix both by: - Changing the xe_hw_engine_group_add_exec_queue() failure path to jump to kill_exec_queue so that xe_exec_queue_kill() properly removes the queue from the VM's compute list. - Adding a del_hw_engine_group label before kill_exec_queue for the xa_alloc() failure path, which removes the queue from the hw engine group before proceeding with the rest of the cleanup. (cherry picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8) The Linux kernel CVE team has assigned CVE-2026-52976 to this issue. Affected and fixed versions =========================== Issue introduced in 6.12 with commit 7970cb36966c9b9183255dc097ae0446300eebcf and fixed in 6.12.91 with commit f93b00161213a0fe9f7ff1d8498ee5ca9e0a5c43 Issue introduced in 6.12 with commit 7970cb36966c9b9183255dc097ae0446300eebcf and fixed in 6.18.33 with commit 753b149d5a433eb19e0c1b0eb4526a6e26120d1f Issue introduced in 6.12 with commit 7970cb36966c9b9183255dc097ae0446300eebcf and fixed in 7.0.10 with commit 1be55646d8a2035343b012dcb12210db7bb8b056 Issue introduced in 6.12 with commit 7970cb36966c9b9183255dc097ae0446300eebcf and fixed in 7.1 with commit f3cc22d4df3ed58439ea7e21daa54c3608e03b78 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-52976 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/xe/xe_exec_queue.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/f93b00161213a0fe9f7ff1d8498ee5ca9e0a5c43 https://git.kernel.org/stable/c/753b149d5a433eb19e0c1b0eb4526a6e26120d1f https://git.kernel.org/stable/c/1be55646d8a2035343b012dcb12210db7bb8b056 https://git.kernel.org/stable/c/f3cc22d4df3ed58439ea7e21daa54c3608e03b78