In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix vm_bind_ioctl double free bug
If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing.
================================================================== BUG: KASAN: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] Free of addr ffff88813bb9b800 by task xe_vm/14198
CPU: 5 UID: 0 PID: 14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021 Call Trace: <TASK> dump_stack_lvl+0x82/0xd0 print_report+0xcb/0x610 ? __virt_addr_valid+0x19a/0x300 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] kasan_report_invalid_free+0xc8/0xf0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] check_slab_allocation+0x102/0x130 kfree+0x10d/0x440 ? should_fail_ex+0x57/0x2f0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? __lock_acquire+0xab9/0x27f0 ? lock_acquire+0x165/0x300 ? drm_dev_enter+0x53/0xe0 [drm] ? find_held_lock+0x2b/0x80 ? drm_dev_exit+0x30/0x50 [drm] ? drm_ioctl_kernel+0x128/0x1c0 [drm] drm_ioctl_kernel+0x128/0x1c0 [drm] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? find_held_lock+0x2b/0x80 ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm] ? should_fail_ex+0x57/0x2f0 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] drm_ioctl+0x352/0x620 [drm] ? __pfx_drm_ioctl+0x10/0x10 [drm] ? __pfx_rpm_resume+0x10/0x10 ? do_raw_spin_lock+0x11a/0x1b0 ? find_held_lock+0x2b/0x80 ? __pm_runtime_resume+0x61/0xc0 ? rcu_is_watching+0x20/0x50 ? trace_irq_enable.constprop.0+0xac/0xe0 xe_drm_ioctl+0x91/0xc0 [xe] __x64_sys_ioctl+0xb2/0x100 ? rcu_is_watching+0x20/0x50 do_syscall_64+0x68/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa9acb24ded
(cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a)
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-headersUpgrade rtlaUpgrade kernel-cross-headersUpgrade kernel-64k-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade perfUpgrade kernel-zfcpdump-modules-coreUpgrade libperfUpgrade kernel-64k-modules-extraUpgrade kernel-docUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-modules-coreUpgrade kernel-64k-debug-coreUpgrade python3-perfUpgrade kernel-rt-64kUpgrade kernelUpgrade kernel-64k-devel-matchedUpgrade kernel-devel-matchedUpgrade kernel-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-64k-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-coreUpgrade kernel-debug-develUpgrade kernel-rt-64k-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-modulesUpgrade kernel-debug-coreUpgrade kernel-rt-debug-coreUpgrade kernel-64k-modulesUpgrade kernel-rtUpgrade kernel-rt-64k-develUpgrade kernel-debug-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-64kUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-develUpgrade kernel-rt-64k-debugUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-tools-libsUpgrade kernel-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debugUpgrade kernel-uki-virtUpgrade kernel-abi-stablelistsUpgrade rvUpgrade kernel-toolsUpgrade kernel-64k-debugUpgrade kernel-64k-develUpgrade kernel-rt-debugUpgrade kernel-modules-extraUpgrade kernel-rt-develUpgrade kernel-debug-modules-extra | Feb 2, 2026 | Jan 26, 2026 |
| Oracle_linux | — | Upgrade kernel | Jan 29, 2026 | Sep 5, 2025 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jan 27, 2026 | Sep 5, 2025 |
| Rocky_linux | — | Upgrade kernel-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debugUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-coreUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debugUpgrade kernel-debug-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-coreUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debuginfoUpgrade kernel-rt-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-tools-libsUpgrade kernel-debug-modulesUpgrade kernel-rt-develUpgrade kernel-rtUpgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-coreUpgrade kernel-modules-extra-matchedUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-coreUpgrade rtlaUpgrade kernel-rt-coreUpgrade kernel-rt-modulesUpgrade python3-perfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-uki-virtUpgrade kernel-modulesUpgrade libperf-debuginfoUpgrade rvUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-modules-coreUpgrade kernel-devel-matchedUpgrade libperfUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdump-develUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-rt-debug-develUpgrade perf | Feb 9, 2026 | Feb 8, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub