High 7.8Published Jun 24, 2026

CVE-2026-52950drm/xe/dma-buf: fix UAF with retry loop

Updated under an hour ago (Oct 28, 2026, 6:10 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: fix UAF with retry loop Retry doesn't work here, since bo will be freed on error, leading to UAF. However, now that we do the alloc & init before the attach, we can now combine this as one unit and have the init do the alloc for us. This should make the retry safe. Reported by Sashiko. v2: Fix up the error unwind (CI) (cherry picked from commit 479669418253e0f27f8cf5db01a731352ea592e7)

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-825
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 before 39fdac6be02eb7c3460518c1c4085f75f935c4ce; from eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 before 827062952ed9bdf4220466c1f05ce452d04bdedf; from eb289a5f6cc668853f9b2ea6aca04afe58ed11c7 before 155a372a1cc50fa93387c5d3cdfd614a61e1afd1	CNA record
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux	from 0:6.12.0-211.37.1.el10_2 not affected	CISA ADP
linux linux_kernel linux:linux_kernel	from 6.18 before 6.18.33; from 6.19 before 7.0.10; 7.1; 7.1; 7.1	NVD

References

References

https://git.kernel.org/stable/c/39fdac6be02eb7c3460518c1c4085f75f935c4ce	patch
https://git.kernel.org/stable/c/827062952ed9bdf4220466c1f05ce452d04bdedf	patch
https://git.kernel.org/stable/c/155a372a1cc50fa93387c5d3cdfd614a61e1afd1	patch
https://access.redhat.com/errata/RHSA-2026:42919
https://access.redhat.com/errata/RHSA-2026:45192
https://access.redhat.com/security/cve/CVE-2026-52950	third-party-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2492318	third-party-advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52950.json	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.