{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-46264","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-05-13T15:03:33.108Z","datePublished":"2026-06-03T15:50:04.620Z","dateUpdated":"2026-08-05T12:30:51.365Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:30:51.365Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Fix sysfs initialization\n\nIn case of devm_add_action_or_reset() failure the provided cleanup\naction will be run immediately on the not yet initialized kobject.\nThis may lead to errors like:\n\n [ ] kobject: '(null)' (ff110001393608e0): is not initialized, yet kobject_put() is being called.\n [ ] WARNING: lib/kobject.c:734 at kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:kobject_put+0xdf/0x250\n [ ] Call Trace:\n [ ]  xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ]  xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ]  xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ]  xe_device_probe+0x5f2/0xc20 [xe]\n [ ]  xe_pci_probe+0x396/0x610 [xe]\n [ ]  local_pci_probe+0x47/0xb0\n\n [ ] refcount_t: underflow; use-after-free.\n [ ] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0\n [ ] Call Trace:\n [ ]  kobject_put+0x174/0x250\n [ ]  xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ]  xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ]  xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ]  xe_device_probe+0x5f2/0xc20 [xe]\n [ ]  xe_pci_probe+0x396/0x610 [xe]\n [ ]  local_pci_probe+0x47/0xb0\n\nFix that by calling kobject_init() and kobject_add() separately\nand register cleanup action after the kobject is initialized.\n\nAlso make this cleanup registration a part of the create helper to\nfix another mistake, as in the loop we were wrongly passing parent\nkobject while registering cleanup action, and this resulted in some\nundetected leaks.\n\n(cherry picked from commit 98b16727f07e26a5d4de84d88805ce7ffcfdd324)"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only from the local PCI/driver probe path (xe_pci_probe → xe_device_probe → xe_sriov_pf_sysfs_init), not from any network protocol handler.\nAC:L - Triggering devm_add_action_or_reset failure is primarily ENOMEM from devres allocation, which an attacker can influence with sustained memory pressure; no rare layout or victim-state race is required beyond that.\nPR:L - No capability beyond a local login is needed to pressure the kernel into ENOMEM during probe on shared hosts; reaching the SR-IOV PF sysfs init path does not require init-namespace root if the Xe PF is already probing (boot, hotplug, or admin rebind).\nUI:N - Exploitation does not depend on a victim opening files or clicking anything; it occurs during automatic driver probe when the failure path runs.\nS:C - The flaw runs in the SR-IOV PF host driver that administers VF isolation; host kernel memory corruption during PF sysfs setup can break the virtualization boundary and impact tenant VFs on cloud/datacenter GPU hosts.\nC:H - Calling kobject_put() on an uninitialized kobject drives refcount underflow on uninitialized kref state, which the fix commit and kernel warnings classify as use-after-free with potential for arbitrary read primitives.\nI:H - The same uninitialized kobject_put()/refcount corruption can corrupt kernel heap metadata and be developed into arbitrary write or code execution, consistent with UAF-class impact.\nA:H - The observed failure mode includes kernel WARN/oops on kobject_put, refcount underflow warnings, and probe/setup failure that can deny GPU/SR-IOV availability on the host."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/xe/xe_sriov_pf_sysfs.c"],"versions":[{"version":"5c170a4d9c530e872f2f788d95258fbaa39b4415","lessThan":"6ae479b1919ee9bd0560fc7af649932dd420d010","status":"affected","versionType":"git"},{"version":"5c170a4d9c530e872f2f788d95258fbaa39b4415","lessThan":"bf7172cd25ed182f30af2cbb9f80c730dc717d8e","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/xe/xe_sriov_pf_sysfs.c"],"versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","status":"unaffected","versionType":"semver"},{"version":"6.19.4","lessThanOrEqual":"6.19.*","status":"unaffected","versionType":"semver"},{"version":"7.0","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"6.19.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.0"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/6ae479b1919ee9bd0560fc7af649932dd420d010"},{"url":"https://git.kernel.org/stable/c/bf7172cd25ed182f30af2cbb9f80c730dc717d8e"}],"title":"drm/xe/pf: Fix sysfs initialization","x_generator":{"engine":"bippy-1.2.0"}}}}