Skip to main content

Linux Kernel CVE-2026-46201

| EUVDEUVD-2026-32828 HIGH
Memory Leak (CWE-401)
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-f9gx-frhw-g435
Linux Information Disclosure
High
Disputed · 7.8 NVD
Share

Severity by source

Sources disagree (Low–High)
NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
May 30, 2026 - 12:05 vuln.today
CVSS changed
May 30, 2026 - 11:22 NVD
7.8 (HIGH)
Patch available
May 28, 2026 - 12:01 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)
CVE Published
May 28, 2026 - 10:16 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()

When xe_dma_buf_init_obj() fails, the attachment from dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before returning the error. Note: we cannot use goto out_err here because xe_dma_buf_init_obj() already frees bo on failure, and out_err would double-free it.

(cherry picked from commit a828eb185aac41800df8eae4b60501ccc0dbbe51)

AnalysisAI

Local privilege-context resource leak in the Linux kernel's Intel Xe DRM driver allows a local user with GPU access to exhaust dma-buf attachments by repeatedly triggering the failure path in xe_gem_prime_import(). The flaw, addressed across multiple stable trees (6.12.90, 7.0.9, 6.18.32, 7.1-rc2), causes a dma-buf attachment to remain attached when xe_dma_buf_init_obj() fails, producing a kernel-side memory and reference leak. EPSS is 0.02% and the issue is not on the CISA KEV list; no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability lives in drivers/gpu/drm/xe, the Direct Rendering Manager driver for Intel Xe-class discrete and integrated GPUs (introduced upstream around Linux 6.8). The DRM PRIME subsystem allows GEM buffer objects to be shared across drivers and processes using dma-buf file descriptors. xe_gem_prime_import() calls dma_buf_dynamic_attach() to create an attachment, then xe_dma_buf_init_obj() to wrap it into an Xe BO; if init fails, the BO is freed but the attachment created by dma_buf_dynamic_attach() was never released with dma_buf_detach(). This is a resource/reference leak (CWE-401-class missing release of memory/reference after effective lifetime) on an error-handling path - the unusual control flow comment in the commit (avoiding goto out_err because of a double-free) shows the bug stems from asymmetric cleanup responsibilities between the two helpers.

RemediationAI

Vendor-released patch: update to Linux 6.12.90, 6.18.32, 7.0.9, or 7.1-rc2 (or any later release that carries the cherry-pick of upstream commit a828eb185aac41800df8eae4b60501ccc0dbbe51), available via the stable trees at https://git.kernel.org/stable/c/111ab678471bf1f90d078d5513bb086b70596c3c and the other three commit URLs in the references. For distribution users, apply the kernel update shipped by your vendor as soon as it lands. If you cannot patch immediately, a workable compensating control is to unload or blacklist the xe module (add 'blacklist xe' under /etc/modprobe.d/ and rebuild initramfs) on systems where the Xe GPU is not required, accepting the trade-off of losing acceleration for affected Intel GPUs and potentially falling back to i915 or software rendering. Restricting access to /dev/dri/render* and /dev/dri/card* via group membership (e.g., remove untrusted users from the 'render' and 'video' groups) reduces the local attack surface, with the trade-off that affected users lose GPU and hardware-accelerated video access.

Same weakness CWE-401 – Memory Leak

View all
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1
CVE-2023-23145 HIGH POC
7.8
CVE-2022-35858 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-46201 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy