CVE-2026-98999

A flaw was found in the Linux kernel's Intel Xe graphics driver (drm/xe). A local user could exploit this vulnerability to cause a denial of service (DoS) or potentially escalate privileges. When a graphics buffer object is pinned both externally and as a display framebuffer, releasing the external reference before the framebuffer reference leaves a stale entry on the driver's tracking list. Once the buffer is subsequently freed, accessing this corrupted list results in a use-after-free condition.

This vulnerability is rated as Important severity because an authenticated local user with access to the GPU rendering interface can corrupt kernel memory structures, potentially enabling privilege escalation to root or causing an immediate system denial of service. The issue requires systems to be running hardware supported by the Intel Xe graphics driver. Standard server installations without dedicated or integrated Intel Xe graphics hardware, or where DRM device nodes are restricted from untrusted users, face negligible exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to relocate buffer object tracking list detachment into common unpin accounting within the Intel Xe graphics driver to guarantee node removal on final unpin: upgrade to Linux kernel 6.18.57, 7.2.11, 7.3 (or the fixed Kernel/Kernel Ivos Qualcomm/Openshift/Ose Rhel Coreos/Kpatch builds), which move pinned_link removal via list_del_init into xe_bo_account_unpin so it unlinks the node during any 1-to-0 pin count transition, closing all 2 injection vectors (interleaved buffer object pinning via external dma-buf export and display framebuffer creation, triggering final unpin via framebuffer release to leave a stale list entry prior to buffer deallocation). Until patched, this is only a concern on Linux systems with Intel Xe graphics hardware and driver (drm/xe) where local users have access to DRM graphics rendering device nodes — Systems without Intel Xe graphics hardware or where DRM device nodes are restricted from untrusted users are unaffected — so restrict local user access to DRM graphics rendering device nodes, confine rendering privileges, and prevent untrusted users from accessing Intel Xe device interfaces. As a compensating measure, deploy KASAN or HWASan to detect use-after-free conditions and corrupted list pointer dereferences when the tracking list is traversed or spliced, enable SLAB freelist randomization and integrity checks to mitigate heap exploitation when manipulating freed buffer objects, enforce SELinux in enforcing mode to restrict local user access to Intel DRM device nodes and confine process domains, enable KASLR to randomize kernel code and data layouts to hinder locating kernel structures during exploitation, enable SMEP to prevent kernel-mode execution of userspace code if list corruption hijacks control flow, and enable SMAP to prevent kernel-mode access to userspace memory during use-after-free exploitation. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free list-corruption defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)