PT-2026-61338 · Linux · Linux
CVE-2026-64021
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/oa: Fix exec queue leak on width check in stream open
In xe oa stream open ioctl(), when param.exec q->width > 1 the
function returns -EOPNOTSUPP directly, skipping the existing
err exec q cleanup path. The exec queue reference obtained by
xe exec queue lookup() is leaked.
The exec queue holds a reference on the xe file, which is only
dropped during queue teardown. The leaked lookup ref is not on
the file's exec queue xarray, so file close cannot release it.
This keeps both the exec queue and the file private state pinned
indefinitely.
Jump to err exec q instead of returning directly so the reference
is released.
(cherry picked from commit 339fa0be9e4a5d69fa47e91f4a36574224fb478f)
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux