CVE-2026-52951

A flaw was found in the Linux kernel's drm/xe/dma-buf subsystem. This vulnerability involves race conditions when handling the invalidate_mappings hook, particularly during buffer object initialization and attachment. An attacker, by triggering specific sequences of operations, could exploit these races to cause a Use-After-Free (UAF) condition or a NULL pointer dereference. This could lead to system instability and crashes, resulting in a Denial of Service (DoS).

A flaw rated IMPORTANT by Red Hat was found in the Linux kernel drm/xe dma-buf buffer object handling, affecting Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 streams that contain the Xe driver; a fix is being pursued for those affected streams. In the dma-buf import path, the buffer object is attached and made visible on the attachments list before it is fully initialized in xe_dma_buf_init_obj(), and on error paths a buffer object that has already been freed can remain attached. If an exporter driver, such as amdgpu, then calls back into the invalidate_mappings hook, that hook can be invoked with an empty, bogus, or freed buffer object, triggering a NULL pointer dereference in the evict path or a use-after-free that crashes the kernel. A local low-privileged attacker able to trigger these dma-buf import and eviction sequences could therefore cause a denial of service, although successful exploitation requires winning a race with complex timing (attack complexity is high). Red Hat Enterprise Linux 6, 7, and 8, as well as the Red Hat Enterprise Linux 9.2 and 9.4 update streams, are not affected because the vulnerable code is not present in those kernels. Red Hat and CVE.org both rate this flaw CVSS 3.1 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so there is no difference from the upstream severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.