CVE-2026-74699 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix memory leak in exec_queue_set_hang_replay_state()
The q->replay_state is blindly overwritten, which can potentially leak memory that was previously allocated by vmemdup_user(). Return an error if q->replay_state is not empty.
Discovered using AI-assisted static analysis confirmed by Intel Product Security.
(cherry picked from commit f6b6cc1118bdbc4265fa8b3bdf8565b26f13e56e)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel's DRM Xe driver, which manages graphics processing units for Intel hardware, contains a memory management flaw within the exec_queue_set_hang_replay_state function. This vulnerability arises from an improper handling of dynamic memory allocation during state updates. Specifically, when setting the hang replay state for an execution queue, the code blindly overwrites the q->replay_state pointer without first checking if it already holds a reference to previously allocated memory. The previous value is not freed before being replaced by a new allocation derived from user-space input via vmemdup_user. This oversight results in a classic resource leak where kernel memory that was dynamically allocated and mapped for prior operations remains inaccessible but still consumes system resources, as the pointer to it is lost when overwritten.
From a technical perspective, this flaw represents an improper cleanup mechanism leading to information exposure or denial of service through resource exhaustion. The vulnerability aligns with CWE-401, which describes missing release of memory after effective allocation. In the context of kernel development, such leaks are particularly concerning because they occur in privileged space and can accumulate over time if triggered repeatedly. An attacker who can interact with the DRM interface to trigger this code path multiple times could gradually deplete available kernel memory pools. While a single instance might have negligible impact, sustained exploitation through repeated calls to set hang replay states on execution queues can lead to significant performance degradation or system instability as free memory reserves are exhausted.
The operational impact of this vulnerability is primarily centered around resource exhaustion and potential denial of service conditions for the graphics subsystem and potentially the broader operating system if kernel memory pressure becomes critical. Although direct remote code execution is not implied by a simple memory leak, the accumulation of unreleased pages can cause out-of-memory errors in other parts of the kernel or force aggressive garbage collection mechanisms that degrade overall system performance. For environments relying on high-availability graphics processing for rendering or compute tasks, this instability could disrupt critical workflows. The vulnerability was identified through AI-assisted static analysis and subsequently verified by Intel Product Security, highlighting the value of automated code review tools in detecting subtle resource management errors that human reviewers might overlook during standard audits.
Mitigation strategies focus on applying the upstream kernel patch that addresses this specific logic error. System administrators should ensure their Linux distributions are updated with the latest stable kernels containing the fix for drm/xe exec_queue_set_hang_replay_state memory leak. For those unable to update immediately, restricting access to DRM interfaces and limiting user privileges associated with graphics execution queues can reduce the attack surface. Additionally, monitoring kernel logs for out-of-memory conditions or unusual memory usage patterns in processes interacting with Intel GPU drivers may help detect exploitation attempts early. Long-term remediation involves enforcing strict coding standards that mandate checking existing pointers before overwriting them and ensuring corresponding free operations are executed to maintain resource integrity. This incident underscores the importance of rigorous validation of user-supplied data handling within kernel modules, particularly when dealing with dynamic memory allocation patterns common in device drivers.