drm/xe/dma-buf: fix UAF with retry loop

CVE	CVE-2026-52950
State	PUBLISHED
Assigner	Linux
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-06-24 17:17:05 UTC
Updated	2026-06-30 03:20:50 UTC
Description	In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: fix UAF with retry loop Retry doesn't work here, since bo will be freed on error, leading to UAF. However, now that we do the alloc & init before the attach, we can now combine this as one unit and have the init do the alloc for us. This should make the retry safe. Reported by Sashiko. v2: Fix up the error unwind (CI) (cherry picked from commit 479669418253e0f27f8cf5db01a731352ea592e7)

Primary CVSS: v3.1 7 HIGH from ADP

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001320000 probability, percentile 0.031030000 (date 2026-07-04)

Problem Types: CWE-825 | CWE-825 Expired Pointer Dereference

Version	Source	Type	Score	Severity	Vector
3.1	ADP	CVSS	7	HIGH	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	416baaa9-dc9f-4396-8d5f-8c081fb06d67	Secondary	7.8	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	Secondary	7	HIGH	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	CNA	DECLARED	7.8	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Source	Vendor	Product	Version	Platforms
CNA	Linux	Linux	affected eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 39fdac6be02eb7c3460518c1c4085f75f935c4ce git	Not specified
CNA	Linux	Linux	affected eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 827062952ed9bdf4220466c1f05ce452d04bdedf git	Not specified
CNA	Linux	Linux	affected eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 155a372a1cc50fa93387c5d3cdfd614a61e1afd1 git	Not specified
CNA	Linux	Linux	affected 6.18	Not specified
CNA	Linux	Linux	unaffected 6.18 semver	Not specified
CNA	Linux	Linux	unaffected 6.18.33 6.18.* semver	Not specified
CNA	Linux	Linux	unaffected 7.0.10 7.0.* semver	Not specified
CNA	Linux	Linux	unaffected 7.1 * original_commit_for_fix	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 10	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 9	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 6	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 7	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 8	Not specified	Not specified

Reference	Source	Link	Tags
bugzilla.redhat.com/show_bug.cgi	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	bugzilla.redhat.com
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52950.json	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	security.access.redhat.com
git.kernel.org/stable/c/39fdac6be02eb7c3460518c1c4085f75f935c4ce	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org
git.kernel.org/stable/c/155a372a1cc50fa93387c5d3cdfd614a61e1afd1	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org
git.kernel.org/stable/c/827062952ed9bdf4220466c1f05ce452d04bdedf	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org
access.redhat.com/security/cve/CVE-2026-52950	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	access.redhat.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Source	Time	Event
ADP	2026-06-24T00:00:00.000Z	Reported to Red Hat.
ADP	2026-06-24T00:00:00.000Z	Made public.

There are currently no legacy QID mappings associated with this CVE.