LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23350: drm/xe/queue: Call fini on exec queue creation fail

In the Linux kernel, the following vulnerability has been resolved: drm/xe/queue: Call fini on exec queue creation fail Every call to queue init should have a corresponding fini call. Skipping this would mean skipping removal of the queue from GuC list (which is part of guc_id allocation). A damaged queue stored in exec_queue_lookup list would lead to invalid memory reference, sooner or later. Call fini to free guc_id. This must be done before any internal LRCs are freed. Since the finalization with this extra call became very similar to __xe_exec_queue_fini(), reuse that. To make this reuse possible, alter xe_lrc_put() so it can survive NULL parameters, like other similar functions. v2: Reuse _xe_exec_queue_fini(). Make xe_lrc_put() aware of NULLs. (cherry picked from commit 393e5fea6f7d7054abc2c3d97a4cfe8306cd6079)

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux graphics-driver cleanup error can leave a damaged execution queue registered after creation fails. That stale object may later cause an invalid memory reference, potentially compromising confidentiality, integrity, or availability. Exploitation requires local, low-privileged access; the supplied sources do not establish remote or active exploitation.

Executive priority

Treat this as a high-priority local privilege-boundary risk, especially on shared systems using drm/xe. It is less urgent than an internet-reachable flaw, but potential impact spans data exposure, modification, and system failure. Patch through supported kernel channels after confirming applicability.

Technical view

In drm/xe, a failed execution-queue creation path omitted finalization after initialization. This left the queue in the GuC lookup list and failed to release its guc_id. Later lookup could reference damaged memory. The fix invokes queue finalization before internal LRCs are freed and permits xe_lrc_put() to accept NULL.

Likely exposure

Exposure is limited to affected Linux kernels using the drm/xe queue functionality. The bundle identifies affected entries involving versions 6.19, 6.19.7, and 7.0, but does not clearly express complete range semantics. Local access with low privileges is required according to CVSS.

Exploitation context

CVSS 3.1 scores this 7.8 with local access, low complexity, low privileges, and no user interaction. Potential confidentiality, integrity, and availability impact is high. The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public exploit.

Researcher notes

The defect is a failure-path lifecycle imbalance: queue initialization lacks corresponding finalization. The stale GuC-list entry can produce a later invalid memory reference. The supplied material does not identify a CWE, exploitation primitive, observed attacks, or precise distribution-specific package versions; researchers should avoid overstating exploitability.

Mitigation direction

  • Identify systems running affected Linux kernel entries and using drm/xe functionality.
  • Apply a vendor-supported kernel update containing the relevant cited stable fix.
  • Prioritize shared or otherwise untrusted multi-user systems where local access is available.
  • If updates are unavailable, review Linux distributor guidance for supported mitigations.

Validation and detection

  • Record each system's running kernel version, not only its installed package version.
  • Determine whether drm/xe functionality is present and actively used on affected systems.
  • Confirm the updated kernel incorporates an applicable cited stable commit.
  • Reboot into the updated kernel and verify the running version afterward.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23350 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-23350Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3c1fa4aa60b146d1fa73b2b87064303f8e4b7952, 3c1fa4aa60b146d1fa73b2b87064303f8e4b7952unaffected
LinuxLinux6.19, 0, 6.19.7, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.