CVE-2026-72361

A flaw was found in the Linux kernel's drm/xe/hw_engine component. An error handling path in the hw_engine_init() function attempts to free a Buffer Object (BO) that is already managed by the device resource management (devm) system. This redundant free operation results in a double-free vulnerability. A local attacker could potentially exploit this to cause memory corruption, leading to a denial of service or possibly arbitrary code execution.

This vulnerability is rated Moderate because exploitation requires local system access and is restricted to systems utilizing Intel Xe graphics hardware. In typical Red Hat Enterprise Linux environments, exposure is limited to installations where this specific GPU driver is loaded and an initialization error occurs during hardware engine setup. Because triggering the double-free condition demands high execution complexity within the driver probe error path, the practical impact is primarily limited to kernel memory corruption or a localized denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.