CVE-2026-46264

Estado: AnalizadaAlta (8.8)—

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pf: Fix sysfs initialization

In case of devm_add_action_or_reset() failure the provided cleanup action will be run immediately on the not yet initialized kobject. This may lead to errors like:

Fix that by calling kobject_init() and kobject_add() separately and register cleanup action after the kobject is initialized.

Also make this cleanup registration a part of the create helper to fix another mistake, as in the loop we were wrongly passing parent kobject while registering cleanup action, and this resulted in some undetected leaks.

Leer descripción completaMostrar menos

(cherry picked from commit 98b16727f07e26a5d4de84d88805ce7ffcfdd324)

Detalles técnicos trazas, registros y código del informe original

 [ ] kobject: '(null)' (ff110001393608e0): is not initialized, yet kobject_put() is being called.
 [ ] WARNING: lib/kobject.c:734 at kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9
 [ ] RIP: 0010:kobject_put+0xdf/0x250
 [ ] Call Trace:
 [ ]  xe_sriov_pf_sysfs_init+0x21/0x100 [xe]
 [ ]  xe_sriov_pf_init_late+0x87/0x2b0 [xe]
 [ ]  xe_sriov_init_late+0x5f/0x2c0 [xe]
 [ ]  xe_device_probe+0x5f2/0xc20 [xe]
 [ ]  xe_pci_probe+0x396/0x610 [xe]
 [ ]  local_pci_probe+0x47/0xb0

 [ ] refcount_t: underflow; use-after-free.
 [ ] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9
 [ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0
 [ ] Call Trace:
 [ ]  kobject_put+0x174/0x250
 [ ]  xe_sriov_pf_sysfs_init+0x21/0x100 [xe]
 [ ]  xe_sriov_pf_init_late+0x87/0x2b0 [xe]
 [ ]  xe_sriov_init_late+0x5f/0x2c0 [xe]
 [ ]  xe_device_probe+0x5f2/0xc20 [xe]
 [ ]  xe_pci_probe+0x396/0x610 [xe]
 [ ]  local_pci_probe+0x47/0xb0

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.17%
Percentil entre todas las CVEs puntuadas: 5
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation75 %
Impacto principalT1059 Command and Scripting Interpreterexecution60 %

Vulnerabilidad CWE-416 (use-after-free) en kernel Linux con acceso local y privilegios limitados (PR:L). Permite escalada de privilegios. El impacto es ejecución de código no autorizado al explotar la referencia liberada.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution Prevention Threat Intelligence Program Restrict Web-Based Content Privileged Account Management Limit Software Installation Behavior Prevention on Endpoint

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

CWE-416

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-46264",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5c170a4d9c530e872f2f788d95258fbaa39b4415",
              "lessThan": "6ae479b1919ee9bd0560fc7af649932dd420d010",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c170a4d9c530e872f2f788d95258fbaa39b4415",
              "lessThan": "bf7172cd25ed182f30af2cbb9f80c730dc717d8e",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/xe/xe_sriov_pf_sysfs.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.19",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver",
              "lessThanOrEqual": "6.19.*"
            },
            {
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/xe/xe_sriov_pf_sysfs.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-06-03T18:16:27.893",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/6ae479b1919ee9bd0560fc7af649932dd420d010",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bf7172cd25ed182f30af2cbb9f80c730dc717d8e",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Fix sysfs initialization\n\nIn case of devm_add_action_or_reset() failure the provided cleanup\naction will be run immediately on the not yet initialized kobject.\nThis may lead to errors like:\n\n [ ] kobject: '(null)' (ff110001393608e0): is not initialized, yet kobject_put() is being called.\n [ ] WARNING: lib/kobject.c:734 at kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:kobject_put+0xdf/0x250\n [ ] Call Trace:\n [ ]  xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ]  xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ]  xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ]  xe_device_probe+0x5f2/0xc20 [xe]\n [ ]  xe_pci_probe+0x396/0x610 [xe]\n [ ]  local_pci_probe+0x47/0xb0\n\n [ ] refcount_t: underflow; use-after-free.\n [ ] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0\n [ ] Call Trace:\n [ ]  kobject_put+0x174/0x250\n [ ]  xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ]  xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ]  xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ]  xe_device_probe+0x5f2/0xc20 [xe]\n [ ]  xe_pci_probe+0x396/0x610 [xe]\n [ ]  local_pci_probe+0x47/0xb0\n\nFix that by calling kobject_init() and kobject_add() separately\nand register cleanup action after the kobject is initialized.\n\nAlso make this cleanup registration a part of the create helper to\nfix another mistake, as in the loop we were wrongly passing parent\nkobject while registering cleanup action, and this resulted in some\nundetected leaks.\n\n(cherry picked from commit 98b16727f07e26a5d4de84d88805ce7ffcfdd324)"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe/pf: Corrección de la inicialización de sysfs\n\nEn caso de fallo de devm_add_action_or_reset(), la acción de limpieza proporcionada se ejecutará inmediatamente en el kobject aún no inicializado. Esto puede provocar errores como:\n\n [ ] kobject: '(null)' (ff110001393608e0): no está inicializado, sin embargo, se está llamando a kobject_put().\n [ ] ADVERTENCIA: lib/kobject.c:734 en kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:kobject_put+0xdf/0x250\n [ ] Call Trace:\n [ ]  xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ]  xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ]  xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ]  xe_device_probe+0x5f2/0xc20 [xe]\n [ ]  xe_pci_probe+0x396/0x610 [xe]\n [ ]  local_pci_probe+0x47/0xb0\n\n [ ] refcount_t: desbordamiento negativo; uso después de liberación.\n [ ] ADVERTENCIA: lib/refcount.c:28 en refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9\n [ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0\n [ ] Call Trace:\n [ ]  kobject_put+0x174/0x250\n [ ]  xe_sriov_pf_sysfs_init+0x21/0x100 [xe]\n [ ]  xe_sriov_pf_init_late+0x87/0x2b0 [xe]\n [ ]  xe_sriov_init_late+0x5f/0x2c0 [xe]\n [ ]  xe_device_probe+0x5f2/0xc20 [xe]\n [ ]  xe_pci_probe+0x396/0x610 [xe]\n [ ]  local_pci_probe+0x47/0xb0\n\nEsto se soluciona llamando a kobject_init() y kobject_add() por separado y registrando la acción de limpieza después de que el kobject esté inicializado.\n\nTambién se hace que este registro de limpieza sea parte del asistente de creación para corregir otro error, ya que en el bucle estábamos pasando incorrectamente el kobject padre al registrar la acción de limpieza, y esto resultó en algunas fugas no detectadas.\n\n(seleccionado de la confirmación 98b16727f07e26a5d4de84d88805ce7ffcfdd324)"
    }
  ],
  "lastModified": "2026-07-22T20:10:00.127",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092",
              "versionEndExcluding": "6.19.4",
              "versionStartIncluding": "6.19"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}