CVE-2026-46264

drm/xe/pf: Fix sysfs initialization

High · published June 3, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
5.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pf: Fix sysfs initialization

In case of devm_add_action_or_reset() failure the provided cleanup

action will be run immediately on the not yet initialized kobject.

This may lead to errors like:

[ ] kobject: '(null)' (ff110001393608e0): is not initialized, yet kobject_put() is being called.

[ ] WARNING: lib/kobject.c:734 at kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9

[ ] RIP: 0010:kobject_put+0xdf/0x250

[ ] Call Trace:

[ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe]

[ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe]

[ ] xe_sriov_init_late+0x5f/0x2c0 [xe]

[ ] xe_device_probe+0x5f2/0xc20 [xe]

[ ] xe_pci_probe+0x396/0x610 [xe]

[ ] local_pci_probe+0x47/0xb0

[ ] refcount_t: underflow; use-after-free.

[ ] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9

[ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0

[ ] Call Trace:

[ ] kobject_put+0x174/0x250

[ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe]

[ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe]

[ ] xe_sriov_init_late+0x5f/0x2c0 [xe]

[ ] xe_device_probe+0x5f2/0xc20 [xe]

[ ] xe_pci_probe+0x396/0x610 [xe]

[ ] local_pci_probe+0x47/0xb0

Fix that by calling kobject_init() and kobject_add() separately

and register cleanup action after the kobject is initialized.

Also make this cleanup registration a part of the create helper to

fix another mistake, as in the loop we were wrongly passing parent

kobject while registering cleanup action, and this resulted in some

undetected leaks.

(cherry picked from commit 98b16727f07e26a5d4de84d88805ce7ffcfdd324)

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00165 · 5.4th percentile
Published
2026-06-03T15:50Z
EPSS history
Timeline
  • 03 JUN 15:50Z
    drm/xe/pf: Fix sysfs initialization
    cvelistv5