CVE-2026-64021: drm/xe/oa: Fix exec_queue leak on width check in stream open
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/oa: Fix execqueue leak on width check in stream open
In xeoastreamopenioctl(), when param.execq->width > 1 the function returns -EOPNOTSUPP directly, skipping the existing errexecq cleanup path. The execqueue reference obtained by xeexecqueuelookup() is leaked.
The exec queue holds a reference on the xefile, which is only dropped during queue teardown. The leaked lookup ref is not on the file's execqueue xarray, so file close cannot release it. This keeps both the exec queue and the file private state pinned indefinitely.
Jump to errexecq instead of returning directly so the reference is released.
(cherry picked from commit 339fa0be9e4a5d69fa47e91f4a36574224fb478f)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 339fa0be9e4a5d69fa47e91f4a36574224fb478f
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64021?
CVE-2026-64021 has a risk score of 27, indicating a moderate severity level.
How do I fix CVE-2026-64021?
To fix CVE-2026-64021, update your Linux kernel to the latest version that includes the patch.
What systems are affected by CVE-2026-64021?
CVE-2026-64021 affects the Linux kernel, specifically systems utilizing the DRM XE core.
What is the impact of CVE-2026-64021?
The impact of CVE-2026-64021 is the potential memory leak in the exec_queue due to improper error handling.
When was CVE-2026-64021 published?
CVE-2026-64021 was published on July 19, 2026.