CVE-2026-53290 Details
Description
In the Linux kernel, the following vulnerability has been resolved: drm/xe/eustall: Fix drm_dev_put called before stream disable in close In xe_eu_stall_stream_close(), drm_dev_put() is called before the stream is disabled and its resources are freed. If this drops the last reference, the device structures could be freed while the subsequent cleanup code still accesses them, leading to a use-after-free. Fix this by moving drm_dev_put() after all device accesses are complete. This matches the ordering in xe_oa_release(). (cherry picked from commit 35aff528f7297e949e5e19c9cd7fd748cf1cf21c)
A use-after-free vulnerability has been addressed in the Linux kernel's handling of EU stall streams within the Direct Rendering Manager (DRM) subsystem. The issue arose because the function 'drm_dev_put()' was called before the stream was properly disabled and its resources released. This premature call could drop the last reference to the device structures, leading to their deallocation while still being accessed by the cleanup code. The vulnerability has been fixed by rearranging the code to ensure that 'drm_dev_put()' is called only after all device interactions are completed, aligning with the correct order used in a related function, 'xe_oa_release()'.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux Kernel Archive.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/84f2bfbe6e38f8b9815ca00826e53b7f51420402 | kernel.org | Patch |
| https://git.kernel.org/stable/c/bebce43f34b5feb8a760aa832eba81e0f8a38871 | kernel.org | Patch |
| https://git.kernel.org/stable/c/dc2d9842c67d883d3200ae33b9c3859dd9492408 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.15, < 6.18.33 >= 6.19, < 7.0.10 7.1 rc1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jun 28, 2026 | CVE Modified | kernel.org |
| Jun 26, 2026 | New CVE Received | kernel.org |