CVE-2026-23162

A double-free vulnerability was found in the Intel Xe GPU driver's NVM (non-volatile memory) initialization. When auxiliary_device_add() fails after auxiliary_device_init() succeeds, the driver incorrectly frees memory that will also be freed by the device release callback, leading to a double-free condition.

This vulnerability affects systems with Intel Xe discrete GPUs (Arc series). Exploitation requires triggering a specific error path during device initialization, which is difficult to achieve reliably. The double-free could potentially lead to memory corruption but practical exploitation for code execution is unlikely.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.