---
id: CVE-2026-46224
title: 'drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure

  When drm_gpuvm_resv_object_alloc() fails, the pre-allocated storage bo
  is not freed. Add xe_bo_free(…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 <
    f9ad21b90162baf1d78f8036ff3813c3ec1ac88e
  - >-
    Linux >= eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 <
    8fa8c2a22585fcb31dc605b91a67bbcca223fdd7
  - >-
    Linux >= eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 <
    93a528f67ce5095bcab46a69839eca97f43dd352
  - Linux 6.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:12:26.811966Z'
published: '2026-05-28'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:13:45.498Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46224'
references:
  - url: 'https://git.kernel.org/stable/c/f9ad21b90162baf1d78f8036ff3813c3ec1ac88e'
  - url: 'https://git.kernel.org/stable/c/8fa8c2a22585fcb31dc605b91a67bbcca223fdd7'
  - url: 'https://git.kernel.org/stable/c/93a528f67ce5095bcab46a69839eca97f43dd352'
tags:
  - cve.org
epss: 0.00117
epssPercentile: 0.01691
ingestedAt: '2026-11-06T16:57:43.323Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure

When drm_gpuvm_resv_object_alloc() fails, the pre-allocated storage bo
is not freed. Add xe_bo_free(storage) before returning the error.

xe_dma_buf_init_obj() calls xe_bo_init_locked(), which frees the bo on
error. Therefore, xe_dma_buf_init_obj() must also free the bo on its own
error paths. Otherwise, since xe_gem_prime_import() cannot distinguish
whether the failure originated from xe_dma_buf_init_obj() or from
xe_bo_init_locked(), it cannot safely decide whether the bo should be
freed.

Add comments documenting the ownership semantics: on success, ownership
of storage is transferred to the returned drm_gem_object; on failure,
storage is freed before returning.

v2: Add comments to explain the free logic.

(cherry picked from commit 78a6c5f899f22338bbf48b44fb8950409c5a69b9)

## Affected

- `Linux >= eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 < f9ad21b90162baf1d78f8036ff3813c3ec1ac88e`
- `Linux >= eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 < 8fa8c2a22585fcb31dc605b91a67bbcca223fdd7`
- `Linux >= eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 < 93a528f67ce5095bcab46a69839eca97f43dd352`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.