PT-2026-46027 · Linux · Linux

Published

2026-06-03

·

Updated

2026-06-03

·

CVE-2026-46264

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/pf: Fix sysfs initialization
In case of devm add action or reset() failure the provided cleanup action will be run immediately on the not yet initialized kobject. This may lead to errors like:
[ ] kobject: '(null)' (ff110001393608e0): is not initialized, yet kobject put() is being called. [ ] WARNING: lib/kobject.c:734 at kobject put+0xd9/0x250, CPU#0: kworker/0:0/9 [ ] RIP: 0010:kobject put+0xdf/0x250 [ ] Call Trace: [ ] xe sriov pf sysfs init+0x21/0x100 [xe] [ ] xe sriov pf init late+0x87/0x2b0 [xe] [ ] xe sriov init late+0x5f/0x2c0 [xe] [ ] xe device probe+0x5f2/0xc20 [xe] [ ] xe pci probe+0x396/0x610 [xe] [ ] local pci probe+0x47/0xb0
[ ] refcount t: underflow; use-after-free. [ ] WARNING: lib/refcount.c:28 at refcount warn saturate+0x68/0xb0, CPU#0: kworker/0:0/9 [ ] RIP: 0010:refcount warn saturate+0x68/0xb0 [ ] Call Trace: [ ] kobject put+0x174/0x250 [ ] xe sriov pf sysfs init+0x21/0x100 [xe] [ ] xe sriov pf init late+0x87/0x2b0 [xe] [ ] xe sriov init late+0x5f/0x2c0 [xe] [ ] xe device probe+0x5f2/0xc20 [xe] [ ] xe pci probe+0x396/0x610 [xe] [ ] local pci probe+0x47/0xb0
Fix that by calling kobject init() and kobject add() separately and register cleanup action after the kobject is initialized.
Also make this cleanup registration a part of the create helper to fix another mistake, as in the loop we were wrongly passing parent kobject while registering cleanup action, and this resulted in some undetected leaks.
(cherry picked from commit 98b16727f07e26a5d4de84d88805ce7ffcfdd324)

Related Identifiers

CVE-2026-46264

Affected Products

Linux