In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix vm_bind_ioctl double free bug
If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing.
================================================================== BUG: KASAN: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] Free of addr ffff88813bb9b800 by task xe_vm/14198
CPU: 5 UID: 0 PID: 14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021 Call Trace: <TASK> dump_stack_lvl+0x82/0xd0 print_report+0xcb/0x610 ? __virt_addr_valid+0x19a/0x300 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] kasan_report_invalid_free+0xc8/0xf0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] check_slab_allocation+0x102/0x130 kfree+0x10d/0x440 ? should_fail_ex+0x57/0x2f0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? __lock_acquire+0xab9/0x27f0 ? lock_acquire+0x165/0x300 ? drm_dev_enter+0x53/0xe0 [drm] ? find_held_lock+0x2b/0x80 ? drm_dev_exit+0x30/0x50 [drm] ? drm_ioctl_kernel+0x128/0x1c0 [drm] drm_ioctl_kernel+0x128/0x1c0 [drm] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? find_held_lock+0x2b/0x80 ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm] ? should_fail_ex+0x57/0x2f0 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] drm_ioctl+0x352/0x620 [drm] ? __pfx_drm_ioctl+0x10/0x10 [drm] ? __pfx_rpm_resume+0x10/0x10 ? do_raw_spin_lock+0x11a/0x1b0 ? find_held_lock+0x2b/0x80 ? __pm_runtime_resume+0x61/0xc0 ? rcu_is_watching+0x20/0x50 ? trace_irq_enable.constprop.0+0xac/0xe0 xe_drm_ioctl+0x91/0xc0 [xe] __x64_sys_ioctl+0xb2/0x100 ? rcu_is_watching+0x20/0x50 do_syscall_64+0x68/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa9acb24ded
(cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a)
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-docUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-64k-modules-extraUpgrade kernel-cross-headersUpgrade kernel-64k-modules-coreUpgrade libperfUpgrade kernel-develUpgrade perfUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-devel-matchedUpgrade kernelUpgrade kernel-rt-64k-debug-coreUpgrade kernel-64k-debug-coreUpgrade python3-perfUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-modules-coreUpgrade rtlaUpgrade kernel-headersUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-64kUpgrade kernel-tools-libs-develUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-coreUpgrade rvUpgrade kernel-rt-debug-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debugUpgrade kernel-debug-uki-virtUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-coreUpgrade kernel-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-rt-64k-debugUpgrade kernel-zfcpdump-develUpgrade kernel-rt-modules-coreUpgrade kernel-rt-64k-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-coreUpgrade kernel-rt-debugUpgrade kernel-uki-virtUpgrade kernel-64k-develUpgrade kernel-toolsUpgrade kernel-rt-debug-develUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-debug-develUpgrade kernel-64k-coreUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-64k-debugUpgrade kernel-64k-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-64kUpgrade kernel-debug-modules-coreUpgrade kernel-rt-64k-develUpgrade kernel-debug-modulesUpgrade kernel-rtUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-modulesUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-tools-libs | Feb 2, 2026 | Jan 26, 2026 |
| Oracle_linux | — | Upgrade kernel | Jan 29, 2026 | Sep 5, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernel | Jan 27, 2026 | Sep 5, 2025 |
| Rocky_linux | — | Upgrade libperf-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-modulesUpgrade rtlaUpgrade perfUpgrade kernel-rt-debug-develUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-zfcpdump-develUpgrade kernel-tools-libs-develUpgrade libperfUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-modules-coreUpgrade kernel-toolsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-devel-matchedUpgrade perf-debuginfoUpgrade kernel-modulesUpgrade rvUpgrade python3-perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debugUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modules-extraUpgrade kernel-debug-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rtUpgrade kernel-debuginfo-common-s390xUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debuginfoUpgrade kernelUpgrade kernel-debug-coreUpgrade kernel-rt-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-debug-debuginfoUpgrade kernel-coreUpgrade kernel-rt-debugUpgrade kernel-debug-modules-coreUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-modules-extra-matchedUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-core | Feb 9, 2026 | Feb 8, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub