Skip to main content

Linux Kernel EUVDEUVD-2026-39895

| CVE-2026-53290 HIGH
Use After Free (CWE-416)
2026-06-26 Linux GHSA-7j5g-6r5q-hq8r
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local render-node access by a low-privileged user (PR:L, AV:L) with no interaction; kernel use-after-free yields high confidentiality, integrity, and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:53 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:40 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 26, 2026 - 19:40 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/eustall: Fix drm_dev_put called before stream disable in close

In xe_eu_stall_stream_close(), drm_dev_put() is called before the stream is disabled and its resources are freed. If this drops the last reference, the device structures could be freed while the subsequent cleanup code still accesses them, leading to a use-after-free.

Fix this by moving drm_dev_put() after all device accesses are complete. This matches the ordering in xe_oa_release().

(cherry picked from commit 35aff528f7297e949e5e19c9cd7fd748cf1cf21c)

AnalysisAI

Use-after-free in the Linux kernel's Intel Xe GPU driver (drm/xe EU stall sampling) lets a local low-privileged user with access to the render/DRM device trigger memory corruption during stream close. In xe_eu_stall_stream_close() the driver calls drm_dev_put() before disabling the stream and freeing its resources, so if that call drops the last reference the device structures may be freed while subsequent cleanup still dereferences them. The defect is patched upstream, no public exploit is identified at time of analysis, and EPSS rates exploitation probability very low (0.17%, 6th percentile).

Technical ContextAI

The flaw lives in the drm/xe kernel-mode driver, the modern DRM driver for Intel discrete (DG2/Arc) and recent integrated (Meteor Lake and newer) GPUs, specifically the EU (Execution Unit) stall sampling subsystem used for GPU performance profiling. The root cause is a classic use-after-free (CWE-416, despite CWE being listed as N/A): object-lifetime mismanagement where the reference-counting teardown via drm_dev_put() is sequenced before the code that still touches the device structures. When the last reference is dropped early, the kernel frees memory that the remaining close path continues to access. The fix reorders drm_dev_put() to run only after all device accesses complete, mirroring the correct ordering already used in xe_oa_release() (the OA/observation-architecture release path).

RemediationAI

Apply the upstream kernel fix that moves drm_dev_put() after all device accesses complete (cherry-picked from commit 35aff528f7297e949e5e19c9cd7fd748cf1cf21c); the patched commits are available at https://git.kernel.org/stable/c/bebce43f34b5feb8a760aa832eba81e0f8a38871, https://git.kernel.org/stable/c/84f2bfbe6e38f8b9815ca00826e53b7f51420402, and https://git.kernel.org/stable/c/dc2d9842c67d883d3200ae33b9c3859dd9492408 - update to the patched stable kernel shipped by your distribution rather than hand-picking exact upstream version numbers, since the EUVD-reported versions are inconsistent. As a compensating control where patching must wait, restrict access to the Intel Xe DRM render nodes (e.g. tighten permissions/ownership on /dev/dri/renderD* and the GPU device group) so untrusted local users cannot open the EU stall stream, and avoid granting GPU profiling access to unprivileged accounts; the trade-off is that this breaks legitimate GPU compute and profiling for restricted users. There is no remote attack surface, so network controls are not relevant.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.1 Affected

Share

EUVD-2026-39895 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy