CVE-2026-80903 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/oa: Fix sync entry leak on OA config emit failure
xe_oa_emit_oa_config() releases the sync entries and the syncs array only on its success path. When it fails before the point of no return (fence allocation, config buffer allocation or batch submission), it returns without touching stream->syncs.
The stream open path handles such failures in the caller, but xe_oa_config_locked() propagates the error without any cleanup, so the syncs array and the fence references held by the parsed entries are leaked. The next config ioctl overwrites stream->syncs, making the memory unreachable for good.
Clean up the parsed syncs when xe_oa_emit_oa_config() fails, matching the cleanup done by the stream open error path.
(cherry picked from commit 8af97b3da2cfce04e6b457c6eb17ed3c1daf912b)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's DRM Xe driver, which manages graphics processing units for Intel hardware, contains a resource management flaw within the OA (Observability Architecture) configuration emission logic. Specifically, the function xe_oa_emit_oa_config is responsible for preparing and submitting performance monitoring configurations to the GPU. This process involves allocating synchronization entries and maintaining an array of sync objects that track the completion status of various operations. The vulnerability arises because this function only releases these resources on its success path. If the operation fails during critical stages such as fence allocation, configuration buffer preparation, or batch submission prior reaching a point of no return, the function returns immediately without cleaning up the allocated memory and reference counts associated with the sync entries.
This lack of cleanup leads to a resource leak that persists across subsequent operations. When an error occurs in xe_oa_emit_oa_config, the error code is propagated back through xe_oa_config_locked without triggering any deallocation routines for the parsed synchronization structures. Consequently, memory allocated for the stream's syncs array and reference counts held by fence objects remain reserved but inaccessible to other parts of the system that might need them. This situation effectively creates a leak of kernel resources, which can degrade system performance over time as more memory is consumed without being freed.
The operational impact becomes severe when subsequent configuration ioctls are issued. The next attempt to configure OA settings will overwrite the stream->syncs pointer with new allocations. Because the previous failed operation did not free its associated sync entries and fences, those resources become permanently unreachable within the kernel's memory management subsystem. This results in a classic use-after-free scenario where the original pointers are lost, yet their underlying objects remain allocated until system reboot or driver unload. Over time, repeated failures can lead to significant memory exhaustion, potentially causing denial of service conditions for other processes relying on GPU resources or triggering out-of-memory kills within the kernel space.
From a classification perspective, this vulnerability aligns with CWE-401, which describes missing release of memory after successful allocation, and CWE-772, referring to missing release of resource before exit or error return. In terms of attack vectors, while primarily impacting system stability rather than providing direct privilege escalation, such leaks can be exploited in denial-of-service attacks by repeatedly triggering configuration failures to exhaust kernel memory resources. This behavior is consistent with patterns observed in ATT&CK techniques related to resource exhaustion and potential impact on availability.
To mitigate this issue, the Linux kernel community has implemented a fix that ensures proper cleanup of parsed synchronization entries whenever xe_oa_emit_oa_config encounters an error condition before completion. The patch modifies the function to release syncs and their associated fences regardless of whether the configuration emission succeeds or fails due to allocation errors. This change mirrors the existing cleanup logic found in the stream open error path, ensuring consistency across different failure modes within the driver. Administrators should apply kernel updates that include this cherry-picked commit 8af97b3da2cfce04e6b457c6eb17ed3c1daf912b to restore proper resource management and prevent potential memory leaks in environments utilizing Intel GPU performance monitoring features.