---
id: CVE-2026-23421
title: 'drm/xe/configfs: Free ctx_restore_mid_bb in release'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/xe/configfs: Free ctx_restore_mid_bb in release

  ctx_restore_mid_bb memory is allocated in wa_bb_store(), but
  xe_config_device_release() only frees ctx_restore_post…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b30d5de3d40c3fa642079bac0d91f17091c5f877 <
    7f971dfd48983074adc7bbcea3ee95ce7aad47cb
  - >-
    Linux >= b30d5de3d40c3fa642079bac0d91f17091c5f877 <
    3557359ea3df32430ea7c30f7a708ca9a91d7e0e
  - >-
    Linux >= b30d5de3d40c3fa642079bac0d91f17091c5f877 <
    e377182f0266f46f02d01838e6bde67b9dac0d66
  - Linux 6.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:30:30.522388Z'
published: '2026-04-03'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:33:46.385Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23421'
references:
  - url: 'https://git.kernel.org/stable/c/7f971dfd48983074adc7bbcea3ee95ce7aad47cb'
  - url: 'https://git.kernel.org/stable/c/3557359ea3df32430ea7c30f7a708ca9a91d7e0e'
  - url: 'https://git.kernel.org/stable/c/e377182f0266f46f02d01838e6bde67b9dac0d66'
tags:
  - cve.org
epss: 0.00117
epssPercentile: 0.01686
ingestedAt: '2026-11-05T22:38:32.132Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/configfs: Free ctx_restore_mid_bb in release

ctx_restore_mid_bb memory is allocated in wa_bb_store(), but
xe_config_device_release() only frees ctx_restore_post_bb.

Free ctx_restore_mid_bb[0].cs as well to avoid leaking the allocation
when the configfs device is removed.

(cherry picked from commit a235e7d0098337c3f2d1e8f3610c719a589e115f)

## Affected

- `Linux >= b30d5de3d40c3fa642079bac0d91f17091c5f877 < 7f971dfd48983074adc7bbcea3ee95ce7aad47cb`
- `Linux >= b30d5de3d40c3fa642079bac0d91f17091c5f877 < 3557359ea3df32430ea7c30f7a708ca9a91d7e0e`
- `Linux >= b30d5de3d40c3fa642079bac0d91f17091c5f877 < e377182f0266f46f02d01838e6bde67b9dac0d66`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.