CVE-2026-53290: drm/xe/eustall: Fix drm_dev_put called before stream disable in close
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/eustall: Fix drmdevput called before stream disable in close
In xeeustallstreamclose(), drmdevput() is called before the stream is disabled and its resources are freed. If this drops the last reference, the device structures could be freed while the subsequent cleanup code still accesses them, leading to a use-after-free.
Fix this by moving drmdevput() after all device accesses are complete. This matches the ordering in xeoarelease().
(cherry picked from commit 35aff528f7297e949e5e19c9cd7fd748cf1cf21c)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Upgrade the Linux kernel drm/xe/eustall driver fix: move drm_dev_put() after all device accesses in xe_eu_stall_stream_close() so device structures are not freed while the stream is being disabled and cleaned up.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53290?
The severity of CVE-2026-53290 is high, with a CVSS score of 7.8.
What does CVE-2026-53290 affect?
CVE-2026-53290 affects the Linux kernel, specifically within the drm/xe/eustall component.
How can I fix CVE-2026-53290?
To fix CVE-2026-53290, update to the latest patched version of the Linux kernel that addresses this vulnerability.
What is the potential impact of CVE-2026-53290?
CVE-2026-53290 can lead to a use-after-free condition, which may result in a denial of service or privilege escalation.
When was CVE-2026-53290 published?
CVE-2026-53290 was published on June 26, 2026.