CVE-2026-23350: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23350 is a resource leak vulnerability in the Linux kernel's DRM Xe (Intel Xe graphics) driver affecting execution queue initialization. When an execution queue creation fails, the corresponding finalization (fini) function is not called, leaving a damaged queue in the exec_queue_lookup list and skipping removal from the GuC (Graphics Utility Controller) list. This can lead to invalid memory references, kernel memory corruption, or system crashes. Affected versions include Linux kernel 6.19 through 6.19.6 and 7.0-rc1 through 7.0-rc7. It carries a CVSS v3.1 base score of 7.8 (High), requiring only local access with low privileges (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime) and CWE-401 (Missing Release of Memory after Effective Lifetime). In the drm/xe/queue subsystem, every call to queue init must have a corresponding fini call to properly deallocate the guc_id and remove the queue from the GuC list. When queue creation fails mid-way, the missing fini call leaves a partially initialized, damaged queue in exec_queue_lookup, which can later be dereferenced as a valid object, causing an invalid memory reference. The fix involves calling __xe_exec_queue_fini() on failure paths and modifying xe_lrc_put() to safely handle NULL parameters, consistent with similar kernel cleanup functions. Patch commits 99f9b5343cae80eb0dfe050baf6c86d722b3ba2e and fae65b8a4449ae556990efcde8d74bec4adc5925 address this issue (Red Hat Bugzilla, Feedly).

Successful exploitation could result in kernel memory corruption, information disclosure, or denial of service (system crash). A local attacker with low privileges could trigger execution queue creation failures in the Intel Xe graphics driver to exploit the dangling reference, potentially escalating privileges or causing a kernel panic. The vulnerability's CVSS score reflects high impacts to confidentiality, integrity, and availability (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Red Hat Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface primarily to multi-user systems or environments where untrusted users can interact with Intel Xe GPU resources.

Update the Linux kernel to version 6.19.7 or later, or to 7.0-rc3 or later, which include the fix via commits 99f9b5343cae80eb0dfe050baf6c86d722b3ba2e and fae65b8a4449ae556990efcde8d74bec4adc5925. Systems running Linux kernel versions 6.19 through 6.19.6 or 7.0-rc1 through 7.0-rc2 with Intel Xe graphics drivers should be prioritized for patching. No configuration-based workaround is documented; upgrading to a patched kernel version is the recommended remediation (Red Hat Bugzilla, Red Hat Advisory).