{"id":"CVE-2026-46224","title":"drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure\n\nWhen drm_gpuvm_resv_object_alloc() fails, the pre-allocated storage bo\nis not freed. Add xe_bo_free(…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 < f9ad21b90162baf1d78f8036ff3813c3ec1ac88e","Linux >= eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 < 8fa8c2a22585fcb31dc605b91a67bbcca223fdd7","Linux >= eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 < 93a528f67ce5095bcab46a69839eca97f43dd352","Linux 6.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:12:26.811966Z"},"published":"2026-05-28","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:13:45.498Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46224","references":[{"url":"https://git.kernel.org/stable/c/f9ad21b90162baf1d78f8036ff3813c3ec1ac88e"},{"url":"https://git.kernel.org/stable/c/8fa8c2a22585fcb31dc605b91a67bbcca223fdd7"},{"url":"https://git.kernel.org/stable/c/93a528f67ce5095bcab46a69839eca97f43dd352"}],"tags":["cve.org"],"epss":0.00117,"epssPercentile":0.01691,"ingestedAt":"2026-11-06T16:57:43.323Z","slug":"CVE-2026-46224","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure\n\nWhen drm_gpuvm_resv_object_alloc() fails, the pre-allocated storage bo\nis not freed. Add xe_bo_free(storage) before returning the error.\n\nxe_dma_buf_init_obj() calls xe_bo_init_locked(), which frees the bo on\nerror. Therefore, xe_dma_buf_init_obj() must also free the bo on its own\nerror paths. Otherwise, since xe_gem_prime_import() cannot distinguish\nwhether the failure originated from xe_dma_buf_init_obj() or from\nxe_bo_init_locked(), it cannot safely decide whether the bo should be\nfreed.\n\nAdd comments documenting the ownership semantics: on success, ownership\nof storage is transferred to the returned drm_gem_object; on failure,\nstorage is freed before returning.\n\nv2: Add comments to explain the free logic.\n\n(cherry picked from commit 78a6c5f899f22338bbf48b44fb8950409c5a69b9)\n\n## Affected\n\n- `Linux >= eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 < f9ad21b90162baf1d78f8036ff3813c3ec1ac88e`\n- `Linux >= eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 < 8fa8c2a22585fcb31dc605b91a67bbcca223fdd7`\n- `Linux >= eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 < 93a528f67ce5095bcab46a69839eca97f43dd352`\n- `Linux 6.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}