CVE-2026-99208: drm/xe/oa: Zero OA buffer at allocation

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/oa: Zero OA buffer at allocation

ttmbotypekernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kernel memory contents.

Streams opened with DRMXEOAPROPERTYOADISABLED allocate the OA buffer without calling xeoainitoabuffer(). Zero the buffer at allocation to prevent information disclosure through mmap.

The existing zeroing in xeoainitoabuffer() remains necessary for zero report-id/timestamp detection on enable/re-enable.

(cherry picked from commit 126c4c5388f9311a390b9b254a835b0cf0f55331)

Affected Software

1 affected component

Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 126c4c5388f9311a390b9b254a835b0cf0f55331

Event History

Oct 28, 2026

CVE Published

via MITRE·10:36 AM

Data Sourced

via MITRE·10:36 AM

Description

Frequently Asked Questions

Who is exposed to this information disclosure?

Systems using the Linux kernel's drm/xe OA functionality are exposed when an OA buffer is allocated for a stream opened with DRM_XE_OA_PROPERTY_OA_DISABLED and that buffer is made accessible through mmap.

What does an attacker need to do to retrieve data?

An attacker needs userspace access sufficient to open the relevant OA stream and mmap its OA buffer. The issue can expose contents from previously freed kernel pages because kernel-type TTM BO allocations are not guaranteed to be zeroed.

Are OA streams created with OA disabled specifically affected?

Yes. Streams opened with DRM_XE_OA_PROPERTY_OA_DISABLED allocate an OA buffer without calling xe_oa_init_oa_buffer(), leaving the mmap-accessible buffer potentially populated with stale memory.

How is the issue addressed?

The fix zeroes the OA buffer when it is allocated, preventing stale kernel memory from being disclosed through mmap. The existing zeroing performed when the buffer is enabled or re-enabled remains in place for report-id and timestamp detection.

CVE-2026-99208: drm/xe/oa: Zero OA buffer at allocation

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this information disclosure?

What does an attacker need to do to retrieve data?

Are OA streams created with OA disabled specifically affected?

How is the issue addressed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this information disclosure?

What does an attacker need to do to retrieve data?

Are OA streams created with OA disabled specifically affected?

How is the issue addressed?