Linux Kernel DRM: Double-Free of Managed BO in xe_gsc
CVE-2026-64517 Published on July 25, 2026
drm/xe/gsc: Fix double-free of managed BO in error path
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/gsc: Fix double-free of managed BO in error path
The error path in xe_gsc_init_post_hwconfig() explicitly frees a BO
allocated with xe_managed_bo_create_pin_map() via
xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm
cleanup action registered, this causes a double-free when devm
unwinds during probe failure.
Remove the explicit free and let devm handle it, consistent with
all other xe_managed_bo_create_pin_map() callers.
(cherry picked from commit 71d61e3e299a17139e47f980a4d6f425b2c59bf7)
Products Associated with CVE-2026-64517
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
Linux:- Version 2e5d47fe7839298fa096970e184aac9bf82c3bd3 and below 7cb975fcd4777e7bad688f66aa0c10c16dd8276b is affected.
- Version 2e5d47fe7839298fa096970e184aac9bf82c3bd3 and below 2c890e71ae26fa32f5a96c3694b71a2c310940e7 is affected.
- Version 2e5d47fe7839298fa096970e184aac9bf82c3bd3 and below 889f70de2b51a877339e1979aab95111b41bed75 is affected.
- Version 2e5d47fe7839298fa096970e184aac9bf82c3bd3 and below d3ded53fab90996e7d94a39049e11962dd066725 is affected.
- Version 6.12 is affected.
- Before 6.12 is unaffected.
- Version 6.12.92, <= 6.12.* is unaffected.
- Version 6.18.34, <= 6.18.* is unaffected.
- Version 7.0.11, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.