Skip to main content

Linux Kernel EUVDEUVD-2026-55569

| CVE-2026-68383 HIGH
2026-08-10 Linux GHSA-hf5h-j5wg-pf5g
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local driver interaction only (AV:L); reliable UAF exploitation for privilege escalation requires precise timing of exec queue teardown vs. fence resolution (AC:H); standard user privileges with DRI group access (PR:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:54 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:04 cve.org
HIGH 7.8
CVE Published
Aug 10, 2026 - 12:04 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/guc: Keep scheduler timeline name alive

The scheduler keeps a pointer to the timeline name, but q->name is freed with the exec queue while scheduler fences can still reference it.

Store the name in struct xe_guc_exec_queue so it shares the scheduler's RCU-deferred lifetime.

(cherry picked from commit 41075f0eb5dcbd3b065d15f15ef7bbe9315188e8)

AnalysisAI

Use-after-free in the Linux kernel's Intel Xe discrete GPU driver (DRM/xe) allows a local unprivileged user to access freed kernel memory via a dangling pointer in the GuC execution queue scheduler. The scheduler retains a pointer to an exec queue's name string (q->name) that is freed when the exec queue is destroyed, while scheduler fence timelines can still dereference it. Affected kernel versions span the 6.12, 6.15, and 6.16 stable series; no active exploitation has been identified (EPSS: 0.16%, not in CISA KEV), though the impact is rated High (CVSS 7.8) due to full kernel memory read/write/crash potential.

Technical ContextAI

The xe kernel module implements the DRM driver for Intel's Xe GPU architecture (Arc Alchemist and successors). It uses the GuC (Graphics Microcontroller Unit) for GPU command submission, organizing workloads into execution queues (xe_exec_queue). Each exec queue carries a name string used by the DRM scheduler to label fence timelines for debugging and tracing. The lifecycle mismatch is the root cause: q->name is freed as part of exec queue teardown, but DRM scheduler fences can outlive their originating exec queue under normal workload conditions. Any post-free dereference of the stale name pointer constitutes a use-after-free (CWE-416, though NVD lists CWE as N/A). The fix, cherry-picked from upstream commit 41075f0eb5dcbd3b065d15f15ef7bbe9315188e8, copies the name into struct xe_guc_exec_queue, which is protected by RCU (Read-Copy-Update) deferred reclamation, guaranteeing the name pointer remains valid for the scheduler's full fence lifetime. CPE data confirms scope: cpe:2.3:a:linux:linux:* - all Linux builds running the xe module on Xe-capable hardware.

RemediationAI

Upgrade to a patched kernel version: Linux 6.12.43 or later for the 6.12.x LTS series, Linux 6.15.11 or later for the 6.15.x series, or Linux 6.16.2 or later for the 6.16.x series; Linux 6.17 and above contain the upstream fix. Stable tree fix commits are available at https://git.kernel.org/stable/c/77fd62412431e8c80ef2ad61466bc76fe425f80a and https://git.kernel.org/stable/c/299bc6d50b1bed7d1f408391736712f01a0855e2. Distribution maintainers (Ubuntu, Debian, RHEL/CentOS, Fedora, SUSE) are expected to backport this fix to their supported kernel packages; check vendor security advisories. As a compensating control where patching is not immediately feasible, blacklist or unload the xe kernel module (echo 'blacklist xe' >> /etc/modprobe.d/blacklist.conf && modprobe -r xe). This eliminates the attack surface entirely but disables Intel Xe GPU functionality, which is disruptive in GPU-accelerated workload environments. Restricting /dev/dri/renderD* permissions to trusted users only (video/render group membership) further limits access but does not eliminate the underlying bug.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55569 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy