CVE-2026-46264: drm/xe/pf: Fix sysfs initialization

Synopsis

A use-after-free vulnerability exists in the Linux kernel's DRM/Xe GPU driver, specifically in the SR-IOV Physical Function (PF) sysfs initialization path. The flaw is reachable locally by a low-privilege user or process on the host and arises when a cleanup action is triggered against a kobject that was never fully initialized, leading to a refcount underflow and use-after-free condition. Successful exploitation allows an attacker to read kernel memory, modify kernel data structures, or crash the system entirely. Patched-image rebuilds at Linux versions 6.19.4 and 7.0 (commits 6ae479b1919ee9bd0560fc7af649932dd420d010 and bf7172cd25ed182f30af2cbb9f80c730dc717d8e) are available on HarborGuard for environments running affected kernel versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerable sysfs initialization path; no administrative credentials are needed.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the condition independently.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads kernel memory, exposing secrets such as session tokens, cryptographic keys, or other process data resident in kernel address space.
• Modifies kernel data structures, enabling privilege escalation or corruption of security-sensitive kernel state.
• Crashes the affected kernel instance, taking down all workloads running on the host.
• The scope change (S:C) means impact can extend beyond the immediate process or container boundary to affect the underlying host kernel shared by co-located workloads.