PT-2026-64738 · Linux · Linux

CVE-2026-64517 · Published 2026-07-25 · Updated 2026-07-25

NVD

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/gsc: Fix double-free of managed BO in error path

The error path in xe gsc init post hwconfig() explicitly frees a BO allocated with xe managed bo create pin map() via xe bo unpin map no vm(). Since the managed BO already has a devm cleanup action registered, this causes a double-free when devm unwinds during probe failure.

Remove the explicit free and let devm handle it, consistent with all other xe managed bo create pin map() callers.

(cherry picked from commit 71d61e3e299a17139e47f980a4d6f425b2c59bf7)

Related Identifiers

CVE-2026-64517

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-64517 · Security Note
• https://git.kernel.org/stable/c/d3ded53fab90996e7d94a39049e11962dd066725 · Note
• https://git.kernel.org/stable/c/889f70de2b51a877339e1979aab95111b41bed75 · Note
• https://git.kernel.org/stable/c/2c890e71ae26fa32f5a96c3694b71a2c310940e7 · Note
• https://git.kernel.org/stable/c/7cb975fcd4777e7bad688f66aa0c10c16dd8276b · Note