{"id":"CVE-2026-52976","revision":"16efdfa90cac4568a3c7e6cc7460994d","records":[{"revision":"16efdfa90cac4568a3c7e6cc7460994d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-52976","aliases":[],"title":"drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()\n\nTwo error handling issues exist in xe_exec_queue_create_ioctl():\n\n1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps\n   to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in\n   preempt fence mode, xe_vm_add_compute_exec_queue() has already added\n   the queue to the VM's compute exec queue list. Skipping the kill\n   leaves the queue on that list, leading to a dangling pointer after\n   the queue is freed.\n\n2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has\n   succeeded, the error path does not call\n   xe_hw_engine_group_del_exec_queue() to remove the queue from the hw\n   engine group list. The queue is then freed while still linked into\n   the hw engine group, causing a use-after-free.\n\nFix both by:\n- Changing the xe_hw_engine_group_add_exec_queue() failure path to jump\n  to kill_exec_queue so that xe_exec_queue_kill() properly removes the\n  queue from the VM's compute list.\n- Adding a del_hw_engine_group label before kill_exec_queue for the\n  xa_alloc() failure path, which removes the queue from the hw engine\n  group before proceeding with the rest of the cleanup.\n\n(cherry picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8)","state":0,"publishedAt":"2026-06-24T16:28:53.147+00:00","modifiedAt":"2026-10-19T19:47:11.627+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/xe/xe_exec_queue.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7970cb36966c9b9183255dc097ae0446300eebcf\",\n                            \"lessThan\": \"f93b00161213a0fe9f7ff1d8498ee5ca9e0a5c43\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7970cb36966c9b9183255dc097ae0446300eebcf\",\n                            \"lessThan\": \"753b149d5a433eb19e0c1b0eb4526a6e26120d1f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7970cb36966c9b9183255dc097ae0446300eebcf\",\n                            \"lessThan\": \"1be55646d8a2035343b012dcb12210db7bb8b056\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7970cb36966c9b9183255dc097ae0446300eebcf\",\n                            \"lessThan\": \"f3cc22d4df3ed58439ea7e21daa54c3608e03b78\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/xe/xe_exec_queue.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.91\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.33\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.10\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/f93b00161213a0fe9f7ff1d8498ee5ca9e0a5c43","https://git.kernel.org/stable/c/753b149d5a433eb19e0c1b0eb4526a6e26120d1f","https://git.kernel.org/stable/c/1be55646d8a2035343b012dcb12210db7bb8b056","https://git.kernel.org/stable/c/f3cc22d4df3ed58439ea7e21daa54c3608e03b78"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-52976","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-52976","identifiers":["CVE-2026-52976"]},"retained":false,"historicalAffected":[]}],"coverage":[]}