Skip to main content

Linux Kernel EUVDEUVD-2026-38818

| CVE-2026-52950 HIGH
Expired Pointer Dereference (CWE-825)
2026-06-24 Linux GHSA-mp35-p2hc-v59q
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local access to the Xe device with low privileges (AV:L/PR:L); AC:H because reliable UAF exploitation needs race timing and heap grooming; full kernel-level C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:31 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:28 cve.org
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/dma-buf: fix UAF with retry loop

Retry doesn't work here, since bo will be freed on error, leading to UAF. However, now that we do the alloc & init before the attach, we can now combine this as one unit and have the init do the alloc for us. This should make the retry safe.

Reported by Sashiko.

v2: Fix up the error unwind (CI)

(cherry picked from commit 479669418253e0f27f8cf5db01a731352ea592e7)

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's Intel Xe DRM graphics driver (drm/xe) arises from a use-after-free in the dma-buf import path, where an error-handling retry loop operates on a buffer object (bo) that has already been freed. Affecting kernel 6.18 series before the 6.18.33 stable fix, a local low-privileged user with access to the Xe DRM device can trigger the freed-object access to corrupt kernel memory or leak data. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a local-only, driver-specific bug rather than mass-exploited remote flaw.

Technical ContextAI

The flaw lives in drm/xe, the Direct Rendering Manager kernel-mode driver for modern Intel graphics hardware, specifically its dma-buf integration. dma-buf is the kernel's cross-subsystem buffer-sharing framework that lets devices import/export shared memory buffers via attachments. In the vulnerable code, a retry loop re-attempted an operation after an error, but on the error path the buffer object (bo) was already freed - so the retry dereferenced freed memory, a classic use-after-free (CWE-416, despite the CWE being listed as N/A in the source data). The upstream fix restructures allocation and initialization to occur before the attach as a single unit, letting init perform the allocation so the retry no longer touches a freed object. The fix is a cherry-pick of upstream commit 479669418253e0f27f8cf5db01a731352ea592e7.

RemediationAI

Vendor-released patch: update to the fixed stable kernel (referenced as 6.18.33) or later, which contains the cherry-picked fix (upstream commit 479669418253e0f27f8cf5db01a731352ea592e7) merging allocation and init to make the retry path UAF-safe. The fix commits are at https://git.kernel.org/stable/c/39fdac6be02eb7c3460518c1c4085f75f935c4ce, https://git.kernel.org/stable/c/827062952ed9bdf4220466c1f05ce452d04bdedf, and https://git.kernel.org/stable/c/155a372a1cc50fa93387c5d3cdfd614a61e1afd1; apply your distribution's corresponding patched kernel package. If immediate patching is not possible, restrict local access to the Xe DRM render/device nodes (e.g., /dev/dri/*) by tightening group membership and permissions so only trusted users/processes can issue dma-buf operations - trade-off: this can break unprivileged GPU compute or sandboxed rendering workloads that legitimately need device access. As a defense-in-depth measure, limit untrusted local code execution on systems with Intel Xe hardware until the kernel is updated.

Same weakness CWE-825 – Expired Pointer Dereference

View all
CVE-2025-49794 CRITICAL POC
9.1
CVE-2024-23310 CRITICAL POC
9.8
CVE-2026-58592 HIGH POC
8.9
CVE-2025-49795 HIGH POC
7.5
CVE-2019-15691 HIGH POC
7.2
CVE-2024-23638 MEDIUM POC
6.5
CVE-2026-53006 CRITICAL
9.8
CVE-2026-52924 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

EUVD-2026-38818 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy