CVE-2026-64517 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/gsc: Fix double-free of managed BO in error path
The error path in xe_gsc_init_post_hwconfig() explicitly frees a BO allocated with xe_managed_bo_create_pin_map() via xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm cleanup action registered, this causes a double-free when devm unwinds during probe failure.
Remove the explicit free and let devm handle it, consistent with all other xe_managed_bo_create_pin_map() callers.
(cherry picked from commit 71d61e3e299a17139e47f980a4d6f425b2c59bf7)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
This vulnerability exists within the Linux kernel's graphics subsystem specifically in the x86 graphics driver implementation known as xe_gsc. The issue manifests as a double-free condition occurring during error handling paths when initializing graphics hardware configuration. The flaw stems from improper resource management where both explicit cleanup code and automatic device-managed cleanup mechanisms attempt to free the same memory object simultaneously.
The technical root cause involves the xe_gsc_init_post_hwconfig() function which contains an error path that explicitly calls xe_bo_unpin_map_no_vm() to free a buffer object allocated through xe_managed_bo_create_pin_map(). However, this buffer object also has a device-managed cleanup action registered via devm (device managed) infrastructure. When the driver probe fails and devm performs its automatic cleanup, it attempts to free the same object that was already explicitly freed in the error path, resulting in undefined behavior and potential system crashes.
This vulnerability directly relates to CWE-415: Double Free, which is a well-known memory management flaw where the same memory location is freed twice. The issue demonstrates poor understanding of the device-managed resource lifecycle within the Linux kernel's driver framework. The fix implements proper resource management by removing the explicit free operation and allowing the devm subsystem to handle cleanup automatically, consistent with patterns used elsewhere in the same codebase.
The operational impact of this vulnerability could be significant as it affects graphics initialization during system boot or driver loading processes. When a hardware probe fails, the double-free condition could trigger kernel oops, system instability, or potentially allow privilege escalation attacks if exploited through carefully crafted error conditions. The vulnerability is particularly concerning in embedded systems or servers where graphics drivers are frequently loaded and unloaded.
Mitigation strategies should focus on ensuring proper resource management patterns within driver code by following established Linux kernel conventions for device-managed resources. Developers should avoid mixing explicit cleanup calls with devm infrastructure, instead relying on the automatic cleanup mechanisms when using xe_managed_bo_create_pin_map() functions. The fix aligns with ATT&CK technique T1068: Exploitation for Privilege Escalation by preventing memory corruption that could lead to system compromise during driver initialization phases. This vulnerability highlights the importance of understanding kernel resource management patterns and proper error handling in device drivers, particularly when dealing with complex allocation and cleanup scenarios involving multiple memory management subsystems.
The fix represents a defensive programming approach that eliminates potential race conditions and memory corruption issues by ensuring resource lifecycles are managed through a single consistent mechanism rather than allowing conflicting cleanup operations to occur simultaneously. This pattern ensures proper adherence to kernel development best practices and reduces the attack surface for memory-related vulnerabilities in graphics driver implementations.