Linux Kernel CVE-2026-68383

Exploitation requires all of the following specific conditions: (1) The target system must have an Intel Xe architecture discrete GPU (e.g., Intel Arc A-series/Alchemist or later) physically installed and recognized by the kernel. (2) The xe kernel module must be loaded and active - systems using the i915 driver or lacking Xe hardware are entirely unaffected. (3) The attacker must hold a local user account with access to DRM render nodes (/dev/dri/renderD*), which on most distributions requires membership in the video or render group - a common default for desktop users but not typically granted to unprivileged server accounts. (4) The UAF is triggered through the exec queue/fence lifecycle interaction, requiring the attacker to be able to submit and destroy GPU workloads. What limits exploitation: hardware dependency (Intel Xe GPU required), local-only attack vector (AV:L), group-level access requirement for DRI nodes, and the complexity of converting a UAF in a name string to a reliable privilege escalation primitive in modern kernels with heap hardening.

The CVSS 7.8 High score with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects the worst-case kernel UAF impact: full confidentiality, integrity, and availability compromise of the system. However, real-world risk is materially lower than the score implies. EPSS at 0.16% (6th percentile) indicates no observed exploitation pressure. The vulnerability is absent from the CISA KEV catalog and no POC is identified at time of analysis. Critically, exploitation is hardware-gated: the system must have an Intel Xe discrete GPU with the xe module loaded and the attacker must have access to /dev/dri/ render nodes - a constraint that excludes the vast majority of Linux deployments. The NVD vector of AC:L is questionable; reliable exploitation of a UAF for code execution (vs. a simple crash) requires timing control over memory reclamation, which is inherently complex. A more conservative AC:H assessment is warranted for exploitation-to-privilege-escalation scenarios, though AC:L is defensible for denial-of-service via system panic. Tags note 'Information Disclosure,' which understates the full C:H/I:H/A:H impact scope. This vulnerability is low operational priority for organizations without Intel Arc GPU deployments and medium priority for those that do.

A local user on a Linux workstation with an Intel Arc GPU opens a DRM file descriptor, submits GPU compute or render workloads that create exec queues with associated GuC scheduler fences, and then rapidly closes or destroys those exec queues while GPU fences remain outstanding. The exec queue teardown frees q->name while the scheduler still holds a live pointer to it; subsequent kernel scheduler activity (fence resolution, logging, or tracing) dereferences the freed memory. An attacker with control over allocation timing could attempt to reclaim the freed name buffer with controlled data, turning the UAF into a kernel read or write primitive for privilege escalation. No public proof-of-concept exploit is known at time of analysis.