PT-2026-30160 · Linux · Linux Kernel
CVE-2026-23466
·
Published
2026-04-03
·
Updated
2026-07-24
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A flaw in the
drm/xe driver allows local privilege escalation due to insufficient protection of GGTT MMIO access. The protection mechanism using drm dev enter() fails if the driver load fails, as drm dev unplug() is not called. Furthermore, devm release functions cannot ensure that all Buffer Objects (BOs) with GGTT mappings are destroyed before the GGTT MMIO region is removed, as some BOs may be freed asynchronously by worker threads. The issue is addressed by implementing an open-coded flag protected by the GGTT lock, which is cleared during the dev fini ggtt() function to disable MMIO access once teardown begins.Recommendations
Update the Linux kernel to a version containing the fix for the
drm/xe driver.
As a temporary mitigation, restrict access to the drm/xe module to minimize the risk of local privilege escalation.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel