LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23162: drm/xe/nvm: Fix double-free on aux add failure

In the Linux kernel, the following vulnerability has been resolved: drm/xe/nvm: Fix double-free on aux add failure After a successful auxiliary_device_init(), aux_dev->dev.release (xe_nvm_release_dev()) is responsible for the kfree(nvm). When there is failure with auxiliary_device_add(), driver will call auxiliary_device_uninit(), which call put_device(). So that the .release callback will be triggered to free the memory associated with the auxiliary_device. Move the kfree(nvm) into the auxiliary_device_init() failure path and remove the err goto path to fix below error. " [ 13.232905] ================================================================== [ 13.232911] BUG: KASAN: double-free in xe_nvm_init+0x751/0xf10 [xe] [ 13.233112] Free of addr ffff888120635000 by task systemd-udevd/273 [ 13.233120] CPU: 8 UID: 0 PID: 273 Comm: systemd-udevd Not tainted 6.19.0-rc2-lgci-xe-kernel+ #225 PREEMPT(voluntary) ... [ 13.233125] Call Trace: [ 13.233126] <TASK> [ 13.233127] dump_stack_lvl+0x7f/0xc0 [ 13.233132] print_report+0xce/0x610 [ 13.233136] ? kasan_complete_mode_report_info+0x5d/0x1e0 [ 13.233139] ? xe_nvm_init+0x751/0xf10 [xe] ... " v2: drop err goto path. (Alexander) (cherry picked from commit a3187c0c2bbd947ffff97f90d077ac88f9c2a215)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel memory-management bug in the Intel Xe graphics driver path. A failed auxiliary device add can cause the same memory to be freed twice. The public record does not provide CVSS, CWE, confirmed impact, or exploitation evidence, so business urgency depends on affected kernel use and vendor backports.

Executive priority

Treat as a patch-tracking issue unless affected Xe-enabled Linux systems are critical or unstable. Because exploitation and severity are not established in the sources, prioritize normal kernel maintenance while confirming whether vendor updates cover deployed versions.

Technical view

After auxiliary_device_init succeeds, xe_nvm_release_dev is responsible for freeing nvm. If auxiliary_device_add fails, auxiliary_device_uninit triggers put_device and the release callback frees it. The old error path could also kfree(nvm), causing a double-free. The fix moves kfree to the init-failure path and removes the extra error cleanup path.

Likely exposure

Exposure appears limited to Linux systems running affected kernels with the drm/xe NVM initialization path present. The source lists Linux 6.17, 6.18.9, and 6.19 as affected data points, plus a related commit identifier, but does not give complete distribution package status.

Exploitation context

The source shows a KASAN double-free report during systemd-udevd on a 6.19.0-rc2 test kernel. There is no KEV listing and no cited evidence of active exploitation, public exploitability, attacker prerequisites, or remote attack path.

Researcher notes

The record is implementation-focused and lacks CVSS, CWE, privilege requirements, and complete fixed-version mapping. Analysis should stay anchored to the auxiliary device cleanup lifetime bug and the two stable commit references, avoiding assumptions about exploitability or impact beyond double-free memory corruption.

Mitigation direction

  • Track kernel vendor advisories and apply updates containing the cited stable fixes.
  • Confirm whether distribution kernels already backported the drm/xe/nvm fix.
  • Prioritize systems using affected Linux kernels with Intel Xe graphics support enabled.
  • If patch status is unclear, seek vendor guidance before relying on workarounds.

Validation and detection

  • Inventory Linux kernel versions and compare against vendor-fixed package information.
  • Check whether the cited stable commits are present in deployed kernel sources.
  • Review kernel logs for KASAN double-free reports mentioning xe_nvm_init.
  • Confirm whether drm/xe is built, loaded, or relevant to deployed hardware.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23162 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7926ba2143d8fef40bb940232818c7363e33598c, 7926ba2143d8fef40bb940232818c7363e33598cunaffected
LinuxLinux6.17, 0, 6.18.9, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.