-

CVE-2026-72311

drm/xe: free madvise VMA array on L2 flush failure

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: free madvise VMA array on L2 flush failure

xe_vm_madvise_ioctl() allocates madvise_range.vmas in get_vmas().
After get_vmas() succeeds with at least one VMA, error paths must go
through free_vmas so the array is released before the madvise details are
destroyed.

The L2 flush validation path added for PAT madvise rejects some
SVM/userptr ranges after get_vmas() has succeeded, but jumps directly to
madv_fini. This skips kfree(madvise_range.vmas), leaking the VMA array on
each failed ioctl.

Jump to free_vmas instead, matching the other validation failure paths
after get_vmas() has succeeded.

(cherry picked from commit c3a1c3579b1250060da73507a4acef712974c78a)
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 4f39a194d41e6b8cb61a91a7bb01b17be59a7d73
Version < bf126747e7bff55e5ba0b1ec10fc5fce99feaed9
Status affected
Version 4f39a194d41e6b8cb61a91a7bb01b17be59a7d73
Version < 14abbed336a2d1bbd726c25d148d2ec0ff928073
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 7.1
Status affected
Version 0
Version < 7.1
Status unaffected
Version <= 7.1.*
Version 7.1.5
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.099
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/bf126747e7bff55e5ba0b1ec10fc5fce99feaed9
https://git.kernel.org/stable/c/14abbed336a2d1bbd726c25d148d2ec0ff928073