{"id":"CVE-2026-64021","summary":"drm/xe/oa: Fix exec_queue leak on width check in stream open","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Fix exec_queue leak on width check in stream open\n\nIn xe_oa_stream_open_ioctl(), when param.exec_q-\u003ewidth \u003e 1 the\nfunction returns -EOPNOTSUPP directly, skipping the existing\nerr_exec_q cleanup path. The exec_queue reference obtained by\nxe_exec_queue_lookup() is leaked.\n\nThe exec queue holds a reference on the xe_file, which is only\ndropped during queue teardown. The leaked lookup ref is not on\nthe file's exec_queue xarray, so file close cannot release it.\nThis keeps both the exec queue and the file private state pinned\nindefinitely.\n\nJump to err_exec_q instead of returning directly so the reference\nis released.\n\n(cherry picked from commit 339fa0be9e4a5d69fa47e91f4a36574224fb478f)","modified":"2026-07-21T03:47:48.652705198Z","published":"2026-07-19T15:39:14.741Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64021.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/04ef7592eaadd9ca8f8f66e76452f73525cff819"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4b0c4f0c1b133d4bfa31c167200bcda646873328"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4d25342543c01310fc4e0cba7cb17c775e2421e2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64021.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64021"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f0ed39830e6064d62f9c5393505677a26569bb56"},{"fixed":"04ef7592eaadd9ca8f8f66e76452f73525cff819"},{"fixed":"4b0c4f0c1b133d4bfa31c167200bcda646873328"},{"fixed":"4d25342543c01310fc4e0cba7cb17c775e2421e2"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64021.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.34"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64021.json"}}],"schema_version":"1.7.5"}