CVE-2026-23418: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23418 is a memory leak vulnerability in the Linux kernel's DRM Xe register state manager (drm/xe/reg_sr). It occurs when xa_store() fails and the newly allocated entry is not freed on the error path, causing a resource leak. Affected kernel versions include 6.14 through 6.18.16, 6.19 through 6.19.6, and 7.0-rc1 through 7.0-rc7. The vulnerability was disclosed on April 3, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-772 (Missing Release of Resource after Effective Lifetime). In the drm/xe/reg_sr subsystem, when xa_store() encounters a failure, the code path does not free the newly allocated entry, resulting in a kernel memory leak. The fix, cherry-picked from upstream commit 6bc6fec71ac45f52db609af4e62bdb96b9f5fadb, introduces a goto fail_free pattern to properly release the allocated memory on error. Exploitation requires local access with low privileges to repeatedly trigger the allocation failure condition (Red Hat Bugzilla, Github Advisory).

The primary impact is availability: a local attacker with low privileges can repeatedly trigger the memory leak in the DRM Xe register state manager to exhaust kernel memory resources, potentially causing system performance degradation or rendering the system unresponsive. There is no confidentiality or integrity impact associated with this vulnerability. The scope is limited to the affected host and does not facilitate lateral movement or data exfiltration (Red Hat Advisory, Github Advisory).

Patches are available in Linux kernel versions 6.18.17+, 6.19.7+, and 7.0-rc3 and later, via stable branch commits 05e3f01974d09d1b746dedf4144f708b5033e76f, 3091723785def05ebfe6a50866f87a044ae314ba, and 4f461da14c7b226d1c4c179ae69956ccb8e134e2 (Github Advisory). SUSE has also released security updates (SUSE-SU-2026:2217-1 and SUSE-SU-2026:2238-1) addressing this vulnerability. As a workaround, restricting local user access to systems with Intel Xe GPU hardware can reduce exposure until patching is feasible.

Red Hat tracked the issue via Bugzilla (Bug 2454776) and assigned it a low severity rating. The upstream kernel CVE announcement was made via the linux-cve-announce mailing list by Greg Kroah-Hartman. The Yocto Project security list and openSUSE security announce list also distributed notifications to their respective communities (Red Hat Bugzilla).