Login Sign Up

CVE-2026-23162

N/A Unknown
Denial of Service

📋 TL;DR

A double-free memory corruption vulnerability in the Linux kernel's Xe graphics driver (drm/xe/nvm) that occurs when auxiliary device addition fails. This affects Linux systems using the Xe graphics driver, potentially allowing local attackers to crash the system or execute arbitrary code. The vulnerability requires local access to trigger.

💻 Affected Systems

Products:
  • Linux kernel with Xe graphics driver (drm/xe/nvm)
Versions: Linux kernel versions containing the vulnerable code up to the fix commit a3187c0c2bbd947ffff97f90d077ac88f9c2a215
Operating Systems: Linux distributions with Xe driver support
Default Config Vulnerable: ⚠️ Yes
Notes: Requires Xe graphics driver to be loaded and used. Systems without Xe hardware or driver not loaded are not affected.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:
  1. Review the CVE details at NVD
  2. Check vendor security advisories for your specific version
  3. Test if the vulnerability is exploitable in your environment
  4. Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel mode, allowing complete system compromise and arbitrary code execution with kernel privileges.

🟠

Likely Case

Kernel panic or system crash leading to denial of service, potentially requiring physical or remote console access to recover.

🟢

If Mitigated

System crash requiring reboot, but no privilege escalation if kernel hardening features like KASAN or KASLR are enabled.

🌐 Internet-Facing: LOW - Requires local access to trigger, not directly exploitable over network.
🏢 Internal Only: MEDIUM - Local users or compromised accounts could exploit this to crash systems or potentially escalate privileges.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Requires local access and ability to trigger the auxiliary device add failure path. Exploitation would require understanding of kernel memory management and driver internals.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commit a3187c0c2bbd947ffff97f90d077ac88f9c2a215 or later

Vendor Advisory: https://git.kernel.org/stable/c/32887d8e4bc0696b3cb6c5915a42b39cfd3434f4

Restart Required: No

Instructions:

1. Update Linux kernel to version containing fix commit a3187c0c2bbd947ffff97f90d077ac88f9c2a215
2. For distributions: Use package manager to update kernel package
3. For custom kernels: Apply the patch from kernel.org and rebuild
4. No reboot required if using live kernel patching (kpatch/kgraft)

🔧 Temporary Workarounds

Disable Xe graphics driver

all

Prevent loading of the vulnerable Xe driver module

echo 'blacklist xe' >> /etc/modprobe.d/blacklist-xe.conf
rmmod xe 2>/dev/null || true

Enable kernel hardening features

all

Enable KASAN and other memory protection features to detect/crash on exploitation attempts

Add 'kasan=on' to kernel boot parameters in GRUB configuration

🧯 If You Can't Patch

  • Restrict local user access to systems with Xe driver loaded
  • Implement strict privilege separation and limit users who can load kernel modules

🔍 How to Verify

Check if Vulnerable:

Check if Xe driver is loaded: lsmod | grep xe && check kernel version against patched versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel contains fix commit: grep -q 'a3187c0c2bbd947ffff97f90d077ac88f9c2a215' /proc/version_signature || uname -r

📡 Detection & Monitoring

Log Indicators:

  • KASAN double-free reports in kernel logs
  • Kernel panic messages related to xe_nvm_init
  • System crashes with Xe driver stack traces

Network Indicators:

  • None - local vulnerability only

SIEM Query:

source="kernel" AND ("double-free" OR "KASAN" OR "xe_nvm")

📊 Metadata

CVE ID: CVE-2026-23162
CVSS v3 Score: N/A (Unknown)
Published: February 14, 2026
Last Updated: February 18, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON