CVE-2026-46264

{"id": "CVE-2026-46264", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5c170a4d9c530e872f2f788d95258fbaa39b4415", "lessThan": "6ae479b1919ee9bd0560fc7af649932dd420d010", "versionType": "git"}, {"status": "affected", "version": "5c170a4d9c530e872f2f788d95258fbaa39b4415", "lessThan": "bf7172cd25ed182f30af2cbb9f80c730dc717d8e", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/xe/xe_sriov_pf_sysfs.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"status": "unaffected", "version": "0", "lessThan": "6.19", "versionType": "semver"}, {"status": "unaffected", "version": "6.19.4", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/xe/xe_sriov_pf_sysfs.c"], "defaultStatus": "affected"}]}], "published": "2026-06-03T18:16:27.893", "references": [{"url": "https://git.kernel.org/stable/c/6ae479b1919ee9bd0560fc7af649932dd420d010", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bf7172cd25ed182f30af2cbb9f80c730dc717d8e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Fix sysfs initialization\n\nIn case of devm_add_action_or_reset() failure the provided cleanup\naction will be run immediately on the not yet initialized kobject.\nThis may lead to errors like:\n\n [ ] kobject: '(null)' (ff110001393608e0): is not initialized, yet kobject_put() is being called.\n [ ] WARNING: lib/kobject.c:734 at kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:kobject_put+0xdf/0x250\n [ ] Call Trace:\n [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ] xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ] xe_device_probe+0x5f2/0xc20 [xe]\n [ ] xe_pci_probe+0x396/0x610 [xe]\n [ ] local_pci_probe+0x47/0xb0\n\n [ ] refcount_t: underflow; use-after-free.\n [ ] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0\n [ ] Call Trace:\n [ ] kobject_put+0x174/0x250\n [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ] xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ] xe_device_probe+0x5f2/0xc20 [xe]\n [ ] xe_pci_probe+0x396/0x610 [xe]\n [ ] local_pci_probe+0x47/0xb0\n\nFix that by calling kobject_init() and kobject_add() separately\nand register cleanup action after the kobject is initialized.\n\nAlso make this cleanup registration a part of the create helper to\nfix another mistake, as in the loop we were wrongly passing parent\nkobject while registering cleanup action, and this resulted in some\nundetected leaks.\n\n(cherry picked from commit 98b16727f07e26a5d4de84d88805ce7ffcfdd324)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe/pf: Correcci\u00f3n de la inicializaci\u00f3n de sysfs\n\nEn caso de fallo de devm_add_action_or_reset(), la acci\u00f3n de limpieza proporcionada se ejecutar\u00e1 inmediatamente en el kobject a\u00fan no inicializado. Esto puede provocar errores como:\n\n [ ] kobject: '(null)' (ff110001393608e0): no est\u00e1 inicializado, sin embargo, se est\u00e1 llamando a kobject_put().\n [ ] ADVERTENCIA: lib/kobject.c:734 en kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:kobject_put+0xdf/0x250\n [ ] Call Trace:\n [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ] xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ] xe_device_probe+0x5f2/0xc20 [xe]\n [ ] xe_pci_probe+0x396/0x610 [xe]\n [ ] local_pci_probe+0x47/0xb0\n\n [ ] refcount_t: desbordamiento negativo; uso despu\u00e9s de liberaci\u00f3n.\n [ ] ADVERTENCIA: lib/refcount.c:28 en refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0\n [ ] Call Trace:\n [ ] kobject_put+0x174/0x250\n [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ] xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ] xe_device_probe+0x5f2/0xc20 [xe]\n [ ] xe_pci_probe+0x396/0x610 [xe]\n [ ] local_pci_probe+0x47/0xb0\n\nEsto se soluciona llamando a kobject_init() y kobject_add() por separado y registrando la acci\u00f3n de limpieza despu\u00e9s de que el kobject est\u00e9 inicializado.\n\nTambi\u00e9n se hace que este registro de limpieza sea parte del asistente de creaci\u00f3n para corregir otro error, ya que en el bucle est\u00e1bamos pasando incorrectamente el kobject padre al registrar la acci\u00f3n de limpieza, y esto result\u00f3 en algunas fugas no detectadas.\n\n(seleccionado de la confirmaci\u00f3n 98b16727f07e26a5d4de84d88805ce7ffcfdd324)"}], "lastModified": "2026-07-22T20:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092", "versionEndExcluding": "6.19.4", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}