CVE-2026-23162

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/nvm: Fix double-free on aux add failure

After a successful auxiliary_device_init(), aux_dev->dev.release

(xe_nvm_release_dev()) is responsible for the kfree(nvm). When

there is failure with auxiliary_device_add(), driver will call

auxiliary_device_uninit(), which call put_device(). So that the

.release callback will be triggered to free the memory associated

with the auxiliary_device.

Move the kfree(nvm) into the auxiliary_device_init() failure path

and remove the err goto path to fix below error.

"

[ 13.232905] ==================================================================

[ 13.232911] BUG: KASAN: double-free in xe_nvm_init+0x751/0xf10 [xe]

[ 13.233112] Free of addr ffff888120635000 by task systemd-udevd/273

[ 13.233120] CPU: 8 UID: 0 PID: 273 Comm: systemd-udevd Not tainted 6.19.0-rc2-lgci-xe-kernel+ #225 PREEMPT(voluntary)

...

[ 13.233125] Call Trace:

[ 13.233126] <TASK>

[ 13.233127]

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References