CVE-2026-46201CWE-401CWE-772

CVE-2026-46201

High · published May 28, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()

When xe_dma_buf_init_obj() fails, the attachment from

dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before

returning the error. Note: we cannot use goto out_err here because

xe_dma_buf_init_obj() already frees bo on failure, and out_err would

double-free it.

(cherry picked from commit a828eb185aac41800df8eae4b60501ccc0dbbe51)

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00175 · 6.7th percentile
Weaknesses
CWE-401 · Missing Release of Memory after Effective Lifetime; CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2026-05-28T14:16Z
Affected products (4)
ProductVersionsFixed in
linux/linux_kernel≥ 6.8, < 6.12.906.12.90
linux/linux_kernel≥ 6.13, < 6.18.326.18.32
linux/linux_kernel≥ 6.19, < 7.0.97.0.9
linux/linux_kernelall versions—
References (4)
EPSS history
Timeline
  • 28 MAY 09:40Z
    drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
    cvelistv5