CVE-2026-46201: drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()

Synopsis

A resource-leak vulnerability in the Linux kernel's DRM/Xe graphics driver allows a local attacker with low-privilege access to exploit a missing DMA-buf attachment cleanup in xe_gem_prime_import(). The flaw is reachable locally and requires only a standard user account, with no network exposure or user interaction needed. Successful exploitation gives the attacker read, write, and denial-of-service capabilities over the affected system. Patched-image rebuilds at fix versions 6.12.90 and 6.18.32 are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to trigger the vulnerable code path.

• AuthenticationRequired

  Any low-privilege local account is sufficient to reach the vulnerable xe_gem_prime_import() code path; administrator rights are not needed.

• Victim interactionNot required

  No victim interaction is required; the attacker can trigger the vulnerability independently without social engineering.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions.

Blast Radius

• A successful attacker can read kernel memory regions, including sensitive data such as credentials or cryptographic material held by the DRM subsystem.
• The attacker can write to kernel memory, enabling modification of driver state or persistent data structures.
• The resource leak can be triggered repeatedly to exhaust kernel DMA-buf attachment resources, crashing the affected graphics driver or the wider kernel.
• All three impact dimensions (confidentiality, integrity, availability) are rated HIGH, meaning full compromise of the affected kernel subsystem is achievable.