CVE-2026-97620

A flaw was found in the Linux kernel's Intel Xe graphics driver (drm/xe). This vulnerability allows a local user to cause an information disclosure because the driver fails to flush the internal graphics cache before memory is reclaimed or reassigned. An unprivileged attacker can exploit this condition to read residual data from memory previously used by other processes.

A missing flush of the untyped L1 dataport cache in the DRM Xe driver can leave stale GPU cached data visible after memory is reclaimed or reused by another GPU context. A local process with permitted GPU access may potentially observe data left by a previous context through reused GPU memory. For the CVSS the PR:L is used because an attacker needs local access to a DRM render node or another authorized GPU interface. The issue is not directly network reachable. Impact is primarily confidentiality exposure. No memory corruption, integrity impact, privilege escalation, or direct denial of service primitive is demonstrated by the patch. Xe2 and later platforms are relevant to this kernel side mitigation. MTL era platforms require separate validation because the described cache flush coupling is not reliable there.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.