{
  "threat_severity" : "Important",
  "public_date" : "2026-06-24T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()",
    "id" : "2492284",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2492284"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-825",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\ndrm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()\nTwo error handling issues exist in xe_exec_queue_create_ioctl():\n1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps\nto put_exec_queue which skips xe_exec_queue_kill(). If the VM is in\npreempt fence mode, xe_vm_add_compute_exec_queue() has already added\nthe queue to the VM's compute exec queue list. Skipping the kill\nleaves the queue on that list, leading to a dangling pointer after\nthe queue is freed.\n2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has\nsucceeded, the error path does not call\nxe_hw_engine_group_del_exec_queue() to remove the queue from the hw\nengine group list. The queue is then freed while still linked into\nthe hw engine group, causing a use-after-free.\nFix both by:\n- Changing the xe_hw_engine_group_add_exec_queue() failure path to jump\nto kill_exec_queue so that xe_exec_queue_kill() properly removes the\nqueue from the VM's compute list.\n- Adding a del_hw_engine_group label before kill_exec_queue for the\nxa_alloc() failure path, which removes the queue from the hw engine\ngroup before proceeding with the rest of the cleanup.\n(cherry picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8)", "A flaw was found in the Linux kernel. Specifically, within the `drm/xe` graphics driver, two error handling issues in the `xe_exec_queue_create_ioctl()` function could lead to memory corruption. This could result in a dangling pointer or a use-after-free vulnerability. A local attacker could potentially exploit these issues to cause a system crash (denial of service) or gain elevated privileges." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-21T00:00:00Z",
    "advisory" : "RHSA-2026:42919",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.37.1.el10_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-52976\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52976\nhttps://lore.kernel.org/linux-cve-announce/2026062440-CVE-2026-52976-d615@gregkh/T" ],
  "name" : "CVE-2026-52976",
  "csaw" : false
}