UBUNTU-CVE-2026-99208: Medium severity vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttmbotypekernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kernel memory contents. Streams opened with DRMXEOAPROPERTYOADISABLED allocate the OA buffer without calling xeoainitoabuffer(). Zero the buffer at allocation to prevent information disclosure through mmap. The existing zeroing in xeoainitoabuffer() remains necessary for zero report-id/timestamp detection on enable/re-enable. (cherry picked from commit 126c4c5388f9311a390b9b254a835b0cf0f55331)
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 126c4c5388f9311a390b9b254a835b0cf0f55331
Event History
Frequently Asked Questions
Who can access the potentially exposed data?
Userspace processes able to mmap the Intel Xe DRM OA buffer are exposed to stale contents from previously freed kernel pages.
What condition triggers the missing initialization?
The affected path occurs when an OA stream is opened with DRM_XE_OA_PROPERTY_OA_DISABLED. In that case, the OA buffer is allocated without xe_oa_init_oa_buffer() being called.
What is the security impact?
This is an information-disclosure issue: the mmap-able OA buffer may contain stale kernel memory because ttm_bo_type_kernel buffer objects are not guaranteed to be zeroed at allocation.