Linux Kernel EUVD-2026-108793

Exploitation requires a system running the Intel Xe GPU driver (drm/xe) and a buffer object that is pinned BOTH externally (e.g. via dma-buf export through xe_bo_pin_external) AND as a display scanout framebuffer via __xe_pin_fb_vma, with the external unpin occurring before the framebuffer performs the final pin_count 1->0 transition - that specific ordering is what leaves the stale pinned_link node. The attacker must therefore be a local user with the ability to allocate GPU buffer objects, perform dma-buf export, and drive display scanout pinning. Limiting factors: AV:L means no remote reach; PR:L means some local GPU/display privilege is needed; the bug only manifests on hardware/configurations using the relatively new Xe driver, and only when the dual-pin plus reverse-unpin sequence is arranged, so it will not trigger in default idle operation.

This is a local-privilege memory-safety flaw (use-after-free / list corruption) in the Linux kernel's drm/xe GPU driver, scored CVSS 7.8 with vector AV:L/AC:L/PR:L/UI:N and full C:H/I:H/A:H impact - consistent with a kernel UAF that can corrupt the xe->pinned.late.external list and be leveraged toward kernel code execution or privilege escalation. The exploitation signals, however, point to low real-world urgency rather than an emergency: EPSS is only 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit or PoC is present in the input (the three git.kernel.org links are stable-tree patch commits, not exploit code). The vuln.today Decision label is 'this_week', which aligns with a patch-available, locally-exploitable kernel bug that merits routine stable-update cadence rather than drop-everything response. The CVSS vector (AV:L) and the description agree that this is local-only and requires the attacker to already have GPU/display access, so there is no network or unauthenticated exposure. No SSVC automatable/technical-impact fields were supplied, and CWE is N/A, so the UAF classification is inferred from the description, not vendor-assigned. Net: a genuine but not urgent fix-on-schedule kernel bug - high CVSS severity, low current exploitation probability, and a constrained local attack surface.

A local user on a system with an Intel Xe GPU allocates a buffer object, pins it both as a dma-buf export (external pin) and as a display scanout framebuffer, then releases the external pin first so the buffer stays linked on the kernel's external pinned list; when the framebuffer unpin later performs the true final unpin without touching that list, the buffer is freed while still linked, leaving a dangling node. The next walk or splice of the pinned list dereferences freed memory, giving a use-after-free the attacker can groom toward kernel memory corruption or privilege escalation. No public exploit or PoC is identified in the available data.