CVE-2026-98280

A flaw was found in the Linux kernel's Intel Xe graphics driver. During device unbinding, internal driver structures are freed before interrupt requests (IRQs) are disabled. If an interrupt occurs during this timing window, it can trigger a use-after-free condition where the system accesses already released memory. A local user could exploit this issue to cause a Denial of Service (DoS) via a system crash or potentially achieve privilege escalation.

This vulnerability is rated as Moderate impact because exploitation requires local access, specific hardware equipped with an Intel Xe graphics controller, and winning a race condition during device unbinding. The Intel Xe driver is only active on newer Intel graphics hardware, and unbinding devices is an administrative operation or triggered by physical device removal. Consequently, unprivileged users face high operational barriers to reliably triggering the memory corruption flaw to cause a denial of service or gain elevated privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.