Skip to main content

Linux Kernel EUVDEUVD-2026-34126

| CVE-2026-46264 HIGH
Use After Free (CWE-416)
2026-06-03 Linux GHSA-c3hw-32vq-7q95
Information Disclosure Linux Use After Free Memory Corruption
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 05, 2026 - 07:28 vuln.today
CVSS changed
Jun 05, 2026 - 07:22 NVD
8.8 (HIGH)
Patch available
Jun 03, 2026 - 19:01 EUVD
CVE Published
Jun 03, 2026 - 15:50 nvd
UNKNOWN (no severity yet)
CVE Published
Jun 03, 2026 - 15:50 nvd
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pf: Fix sysfs initialization

In case of devm_add_action_or_reset() failure the provided cleanup action will be run immediately on the not yet initialized kobject. This may lead to errors like:

[ ] kobject: '(null)' (ff110001393608e0): is not initialized, yet kobject_put() is being called. [ ] WARNING: lib/kobject.c:734 at kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9 [ ] RIP: 0010:kobject_put+0xdf/0x250 [ ] Call Trace: [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe] [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe] [ ] xe_sriov_init_late+0x5f/0x2c0 [xe] [ ] xe_device_probe+0x5f2/0xc20 [xe] [ ] xe_pci_probe+0x396/0x610 [xe] [ ] local_pci_probe+0x47/0xb0

[ ] refcount_t: underflow; use-after-free. [ ] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9 [ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0 [ ] Call Trace: [ ] kobject_put+0x174/0x250 [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe] [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe] [ ] xe_sriov_init_late+0x5f/0x2c0 [xe] [ ] xe_device_probe+0x5f2/0xc20 [xe] [ ] xe_pci_probe+0x396/0x610 [xe] [ ] local_pci_probe+0x47/0xb0

Fix that by calling kobject_init() and kobject_add() separately and register cleanup action after the kobject is initialized.

Also make this cleanup registration a part of the create helper to fix another mistake, as in the loop we were wrongly passing parent kobject while registering cleanup action, and this resulted in some undetected leaks.

(cherry picked from commit 98b16727f07e26a5d4de84d88805ce7ffcfdd324)

AnalysisAI

Local privilege escalation potential exists in the Linux kernel's Intel Xe DRM driver (drm/xe/pf) due to a sysfs initialization ordering bug in SR-IOV Physical Function setup, where a failed devm_add_action_or_reset() call invokes kobject_put() on an uninitialized kobject, triggering refcount underflow and use-after-free conditions. The flaw affects Linux kernel 6.19 prior to the 6.19.4 stable patch and has been resolved upstream; no public exploit identified at time of analysis and EPSS rates exploitation probability at only 0.02%.

Technical ContextAI

The vulnerability resides in the Intel Xe graphics driver's SR-IOV (Single Root I/O Virtualization) Physical Function sysfs initialization path (xe_sriov_pf_sysfs_init). The Linux device-managed resource API devm_add_action_or_reset() guarantees that if registration of a cleanup action fails, the cleanup action is invoked immediately - but the original code registered the cleanup before properly initializing the underlying kobject via kobject_init()/kobject_add(). This produced a classic use-after-free / refcount underflow on the kobject reference counter, as evidenced by the kernel WARN traces calling kobject_put() on a NULL-named, uninitialized kobject. A secondary bug existed in a loop that passed the parent kobject (rather than the child) as the cleanup target, causing undetected resource leaks. The root cause class is improper resource lifecycle management around reference-counted kernel objects, a recurring pattern in Linux driver code despite no CWE being formally assigned.

RemediationAI

Vendor-released patch: Linux stable 6.19.4 - upgrade to 6.19.4 or later, which incorporates the upstream fix that splits kobject_init() and kobject_add() and moves cleanup-action registration into the create helper after the kobject is properly initialized. The fix commits are available at https://git.kernel.org/stable/c/6ae479b1919ee9bd0560fc7af649932dd420d010 and https://git.kernel.org/stable/c/bf7172cd25ed182f30af2cbb9f80c730dc717d8e and distributors should pick up these patches in their stable backports. If kernel upgrade is not immediately feasible, a targeted compensating control is to avoid enabling SR-IOV on Intel Xe GPUs (do not assign VFs via sysfs sriov_numvfs) on affected kernels, or unload the xe module on systems that do not require Intel discrete GPU acceleration - the trade-off being loss of GPU functionality or virtualization for those workloads. Restricting unprivileged access to /sys/class/drm and the PCI sysfs hierarchy provides marginal defense in depth but does not eliminate the underlying probe-time race.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-34126 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy