CVE-2026-68244 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gem: Do not leak siblings[] on proto context error
After a successful BALANCE/PARALLEL_SUBMIT extension on context creation, error during processing of next user extension leaks the siblings[] array. Fix that.
Discovered using AI-assisted static analysis confirmed by Intel Product Security.
(cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability resides in the intel i915 graphics driver within the linux kernel, specifically affecting the graphics execution manager gem subsystem. The issue manifests during context creation when the driver processes BALANCE/PARALLEL_SUBMIT extensions for user space applications. The flaw occurs in the protocol context handling logic where an error condition during subsequent extension processing fails to properly clean up allocated resources. The siblings[] array, which maintains references to related context objects, becomes leaked when the error path is taken without proper resource deallocation.
The technical implementation involves the driver's context management code that maintains a collection of sibling contexts for parallel execution scenarios. When the initial BALANCE/PARALLEL_SUBMIT extension succeeds but subsequent user extensions encounter errors during processing, the cleanup routine fails to iterate through and properly release all elements within the siblings[] array. This represents a classic resource leak pattern where memory allocated for context relationships is not freed, leading to gradual memory consumption over time.
The operational impact of this vulnerability extends beyond simple memory waste to potentially affect system stability and performance under sustained graphics workloads. Applications utilizing parallel context submission patterns may experience progressive memory consumption that could eventually lead to system resource exhaustion. The leak becomes particularly concerning in high-performance computing environments or systems handling multiple concurrent graphics applications where context switching occurs frequently. This vulnerability directly relates to weakness category CWE-404, which addresses improper resource management and memory leaks in software systems.
The fix implements proper error path handling by ensuring that when extension processing fails after successful initial BALANCE/PARALLEL_SUBMIT execution, the siblings[] array elements are properly iterated and released before returning the error condition. This approach aligns with ATT&CK technique T1490, which involves resource exhaustion through memory leaks in system processes. The solution addresses the root cause by establishing a consistent cleanup routine that executes regardless of whether extension processing succeeds or fails.
Security implications extend to potential denial of service scenarios where sustained exploitation could lead to system instability. While this vulnerability does not directly enable privilege escalation or remote code execution, it creates conditions where system resources become unavailable for legitimate operations. The fix demonstrates proper defensive programming practices by ensuring resource cleanup occurs in all code paths, particularly error conditions that might be overlooked during initial development. This vulnerability highlights the importance of comprehensive testing of error handling routines and proper resource management in kernel subsystems, especially those dealing with parallel execution contexts where multiple related objects must maintain consistent state throughout their lifecycle.